Replace ARRAY-based allowed_docker_registries lookups with ASE-backed reads

## Description

Replace every read of `domains.allowed_docker_registries` (the ARRAY column) with a JOIN against `association_scopes_entities` and `container_registries`. Compare by registry id rather than name so that the same-name correctness bug is fixed at the read boundary.

## Target Locations

- `models/image/row.py` line 1251 (allowed-registries lookup in user scope).
- `models/image/row.py` line 1314 (image query in domain scope).
- `api/gql_legacy/image.py` line 326 (filter_allowed).
- `registry.py` line 445.
- `registry.py` line 782.
- `repositories/scheduler/db_source/db_source.py` line 2832.

## Implementation Notes

- ASE filter clause: `scope_type=DOMAIN AND scope_id=domain.name AND entity_type=CONTAINER_REGISTRY`.
- Image/session checks compare `images.registry_id == ase.entity_id` (id-based).
- Callers that still need name strings (gql_legacy resolvers, log lines) join to `container_registries.name` explicitly.

## Success Criteria

- Only registries actually mapped in ASE are allowed; same-name registries no longer pass together by accident.
- No regressions in image listing, session creation, or scheduler validation.
- pants test passes.

JIRA Issue: BA-6088