Sync pipeline: mirror stage hard-fails on toggle-gated images that were never pushed

Nobody has claimed this yet.

### Problem statement

In `.pipeline/sync-container-images.yml`, the `Mirror_To_GHCR` stage reads its image list from an unconditional heredoc (`images.txt`), but many of the images in that list are produced by jobs gated behind queue-time toggles — `buildKerberosImages`, `syncAlpine3`, `syncCentOS`, `syncSUSE`, `buildPythonImages`, `buildUbuntuImages`.

The mirror loop treats any tag it cannot resolve as fatal:

```bash
if docker buildx imagetools create -t "$dst" "$src"; then
echo " OK"
else
echo " FAILED: ${src}"
FAIL=1
fi
...
if [ "$FAIL" -ne 0 ]; then exit 1; fi
```

So queuing the pipeline with a toggle set to `false` for an image that has never been pushed to ACR fails the mirror stage — and because the task carries `retryCountOnTaskFailure: 3`, it burns three retries first.

This is pre-existing shape rather than a regression. It was raised in review on #163, which tripled the size of the mirror list and added the `kerberos/*` namespace. That specific window has since closed (those images are now in ACR and public in GHCR), so this is a latent sharp edge rather than an active break.

### Proposed solution

Downgrade a missing **source** image to a warning while keeping `FAIL=1` for a genuine **push** failure. These are different conditions and only one is actionable by the pipeline: a source that isn't in ACR means the producing job was toggled off, whereas a push failure means the mirror itself is broken.

Sketch:

```bash
if ! docker buildx imagetools inspect "$src" >/dev/null 2>&1; then
echo " SKIP: ${src} not present in ACR (producing job likely disabled)"
continue
fi
if docker buildx imagetools create -t "$dst" "$src"; then
echo " OK"
else
echo " FAILED to push: ${dst}"
FAIL=1
fi
```

### Alternatives considered

Emitting the list conditionally, e.g. wrapping each group in `${{ if eq(parameters.buildKerberosImages, true) }}`. This works, but it couples the mirror list to the build toggles and silently shrinks the mirror on a partial run — trading a loud failure for a quiet one. The warn-on-missing-source approach keeps the full list as the declared intent and reports what was skipped.

A third option is to leave it as-is and treat the failure as a useful signal that someone queued an inconsistent combination. That is defensible, but the 3 retries make the feedback slow and the error message doesn't point at the cause.

### Additional context

- Raised by @David-Engel in review on #163: https://github.com/microsoft/mssql-rs/pull/163
- Mirror loop is at `.pipeline/sync-container-images.yml` around line 1365.
- Related operational note: new GHCR packages are created **private**, and visibility is only settable per-package in the GitHub UI — there is no REST or GraphQL endpoint for it. Any newly added mirror entry therefore needs a manual visibility flip before consumers can pull it anonymously. Worth considering whether the verify step should probe anonymous pullability and warn, so a forgotten flip surfaces in the pipeline rather than in a downstream consumer.

Start in .pipeline/sync-container-images.yml around line 1365 and read the Mirror_To_GHCR loop, including its retry configuration and FAIL handling. Run a pipeline configuration with a producing toggle disabled, then verify that missing source images are warned and skipped while genuine push failures still fail the stage.

Written by the indexing model from the issue text.