Isolate OCI push tests from the ambient localhost registry

> 🤖 Generated by the Agentic Engineer

## Description

Two OCI push tests depend on whatever is listening on `localhost:5000` instead of a registry fixture owned by the test:

- `TestPushOCIArtifact_MissingDirectory_PushesEmptyArtifact`
- `TestPushOCIArtifact_UsesDefaultSourceDir`

Both call the real `PushOCIArtifact` with `context.Background()`. Their comments assume the registry operation will fail, but the missing-directory test also accepts a successful push. This makes unit-test behavior depend on the developer's machine and permits writes to an unrelated local registry.

## Steps to Reproduce

1. Inspect the [two tests at the current base commit](https://github.com/devantler-tech/ksail/blob/aee52af25c5751e58abc978c78f0be77f15a377e/pkg/svc/registryresolver/oci_test.go#L25-L150).
2. Follow their call into [the actual artifact build/push path](https://github.com/devantler-tech/ksail/blob/aee52af25c5751e58abc978c78f0be77f15a377e/pkg/svc/registryresolver/oci.go#L64-L143): no test-owned registry or injected transport separates the tests from the fixed endpoint.
3. During validation for #6887, `go test -p=2 ./...` passed, but the registryresolver package took `218.320s` on macOS with Go 1.26.6. The package was observed waiting after other test processes finished. Timing alone does not identify the entire delay; the fixed endpoint dependency is established by the source.

## Expected Behavior

The tests deterministically verify empty-artifact and default-source-directory behavior against isolated resources, without depending on or writing to ambient services.

## Actual Behavior

A fixed local endpoint and unbounded background context determine the push result; assertions allow connection failure in place of directly verifying the intended artifact behavior.

## Acceptance Criteria

- [ ] Replace fixed-port access in the two tests with a test-owned registry on an ephemeral port or an existing transport seam at the external boundary.
- [ ] Assert the requested repository and empty/non-empty artifact behavior, including the default `k8s` source directory.
- [ ] Bound network work to the test lifetime and close every test resource.
- [ ] Repeated execution is deterministic without a Docker daemon, an ambient registry, or user credentials; the full package suite passes.
- [ ] Keep production artifact publishing behavior unchanged.

Scope: small test-isolation repair. Discovered while validating #6887; this is separate from its EKS implementation.

Start with the two tests in pkg/svc/registryresolver/oci_test.go and trace their calls into pkg/svc/registryresolver/oci.go. Replace the ambient localhost:5000 dependency with an isolated test resource or existing external-boundary seam, then verify repository and empty/non-empty artifact behavior, including the default k8s source directory. Run the registryresolver package tests and confirm resources are closed and production publishing is unchanged.

Written by the indexing model from the issue text.