Build Week 8: debezium push - OCI image registry push

Following Week 7 (`debezium build`, `debezium build --image`, OCI image assembly via Jib), Week 8 implements `debezium push` - authenticating and pushing the assembled OCI image to Docker Hub, GHCR or a custom registry.

---

## Part 1: Registry authentication

**Proposed behaviour:**
- Read credentials from the user's existing Docker credential store (`~/.docker/config.json`) - if the user is already logged in via
`docker login`, no extra setup needed
- Fallback to environment variables: `DBZ_REGISTRY_USERNAME` / `DBZ_REGISTRY_PASSWORD`
- Final fallback: registry credentials in `~/.dbz/config.yaml`
- Resolution order: env vars → `~/.dbz/config.yaml` → `~/.docker/config.json`

**Implementation:**
- `RegistryAuthResolver.java` — implements the three-level credential resolution chain
- Unit tests for each resolution path

---

## Part 2: `debezium push`

```bash
debezium push
debezium push --registry ghcr.io/myorg
debezium push --config path/to/dbz.yaml # defaults to ./dbz.yaml