`credsStore` in docker config causes unit test failures

### What happened?

`nix run .#test` fails when running locally in a few tests like `TestFindImageTagForVersionConstraint`, `TestKCLBuild`, and `TestGoTemplatingBuild` for anyone whose `~/.docker/config.json` sets a `credsStore`. CI never hits it, since the runner has no Docker config.

The test app runs with [`inheritPath = false`](https://github.com/crossplane/cli/blob/b2a5e3c8ef3da66d427c0827a422bc43c88ef0b5/nix/apps.nix#L25), so `PATH` holds Go and nothing else. `findImageTagForVersionConstraint` calls [`crane.ListTags`](https://github.com/crossplane/cli/blob/b2a5e3c8ef3da66d427c0827a422bc43c88ef0b5/cmd/crossplane/validate/image.go#L197), which resolves auth through `authn.DefaultKeychain`. A configured `credsStore` sends that to `docker-credential-`, which isn't on the stripped `PATH`:

```
cannot fetch tags for the image 127.0.0.1:62645/ubuntu: error getting credentials - err: exec: "docker-credential-desktop": executable file not found in $PATH, out: ``
```

The test never surfaces that error. The [assertion](https://github.com/crossplane/cli/blob/b2a5e3c8ef3da66d427c0827a422bc43c88ef0b5/cmd/crossplane/validate/image_test.go#L120) only reports the empty `got`, so it reads like the local registry was unreachable rather than a credential lookup that never got that far.

### How can we reproduce it?

With `"credsStore"` set in `~/.docker/config.json`, run unit tests with:

```
nix run .#test
```

and you'll see failures like:

```
--- FAIL: TestFindImageTagForVersionConstraint (0.00s)
--- FAIL: TestFindImageTagForVersionConstraint/Constraint (0.00s)
image_test.go:120: [Constraint] expected: 127.0.0.1:53321/ubuntu:4.5.6, got:
--- FAIL: TestFindImageTagForVersionConstraint/ConstraintV (0.00s)
image_test.go:120: [ConstraintV] expected: 127.0.0.1:53322/ubuntu:4.5.6, got:
--- FAIL: TestFindImageTagForVersionConstraint/ConstraintPreRelease (0.00s)
image_test.go:120: [ConstraintPreRelease] expected: 127.0.0.1:53323/ubuntu:4.5.6, got:
--- FAIL: TestFindImageTagForVersionConstraint/RangedConstraint (0.00s)
image_test.go:120: [RangedConstraint] expected: 127.0.0.1:53326/ubuntu:4.5.6, got:
--- FAIL: TestFindImageTagForVersionConstraint/CommaSeparatedRangedConstraint (0.00s)
image_test.go:120: [CommaSeparatedRangedConstraint] expected: 127.0.0.1:53327/ubuntu:4.5.6, got:
...
--- FAIL: TestKCLBuild (0.06s)
build_test.go:194: failed to fetch KCL base image: failed to pull image: error getting credentials - err: exec: "docker-credential-desktop": executable file not found in $PATH, out: ``
--- FAIL: TestGoTemplatingBuild (0.06s)
build_test.go:264: failed to fetch go-templating base image: failed to pull image: error getting credentials - err: exec: "docker-credential-desktop": executable file not found in $PATH, out: ``
```

Isolating the Docker config is enough to make them pass, which confirms where the failure comes from:

```
DOCKER_CONFIG=$(mktemp -d) nix run .#test
```

### Possible fix

The test probably shouldn't consult ambient Docker credentials at all. Perhaps `t.Setenv("DOCKER_CONFIG", t.TempDir())` at the top of it, along with printing `err` in the failure message so the next person doesn't have to dig for the cause.