bootc install to-existing-root --source-imgref has no way to authenticate to a private registry

### Summary

`new_proxy_config()` (`crates/lib/src/deploy.rs`) only sets `user_agent_prefix`. Every auth field on `ImageProxyConfig` is left at its default (anonymous). Neither a CLI flag on `to-existing-root` nor `REGISTRY_AUTH_FILE` in the environment reaches the spawned image-proxy subprocess, so installing from a private `--source-imgref` fails with `unauthorized` regardless of valid local credentials. Confirmed `skopeo` itself succeeds against the same registry using the same credentials.

Worked around this by making the target image public. Not sure if the gap is intentional or an oversight, flagging either way.

Start in crates/lib/src/deploy.rs at new_proxy_config() and trace the to-existing-root command into the spawned image-proxy subprocess. Check how ImageProxyConfig and REGISTRY_AUTH_FILE are handled, then verify that a private --source-imgref can authenticate with the same local credentials that make skopeo succeed.

Written by the indexing model from the issue text.