RHEL subscription-manager macro or documented pattern for self-service images

Problem

Self-service customers building their own images (unlike Posit's own first-party product images, which only ever target UBI — see images-shared#575) may target full subscription-gated RHEL rather than UBI. Bakery has no pattern for this today: BuildSecret (config/image/build_secret.py) is a generic mechanism for passing secrets to docker buildx build, but nothing wires it to subscription-manager register or conditional CodeReady Builder enablement.

container-generator's own approach: Red Hat credentials in a separate .pw file, copied in and deleted after registration, with conditional CRB/EPEL enablement differing between RHEL 8 and 9.

Scope

A macro (or documented pattern, if a macro is overkill for what's essentially one subscription-manager register call plus cleanup) parallel to the existing package-manager macros (apt.j2/dnf.j2), using BuildSecret for credential passing rather than embedding credentials in the Containerfile.

Non-goal

Distinct from images-shared#575's UBI work — UBI is deliberately subscription-free, so this pattern is never needed there.

Start with config/image/build_secret.py and compare the existing apt.j2 and dnf.j2 package-manager macros. Review how container-generator handles the credential file, registration cleanup, and conditional CRB/EPEL behavior for RHEL 8 and 9. Done means a documented macro or pattern uses BuildSecret without embedding credentials and covers the required registration flow.