Add ECR support to Bakery registry cleanup tooling

Background

Amazon ECR Public has no native lifecycle-policy feature (confirmed via aws ecr-public help — no put-lifecycle-policy/get-lifecycle-policy, unlike private ecr; also absent
from AWS docs). The only deletion mechanism is batch-delete-image by tag or digest. Cleanup
has to be enforced client-side, the same way Bakery already handles this for GHCR
(posit_bakery/registry_management/ghcr/) and Docker Hub
(posit_bakery/registry_management/dockerhub/).

bakery clean cache-registry and bakery clean temp-registry currently document themselves
as GHCR-only:

⚠️ This command currently only supports GHCR registries. ⚠️

This issue adds ECR as a supported registry for that cleanup tooling, so any image publishing
to ECR can prune old/untagged images the same way GHCR- and Docker Hub-published images do.

Scope

• Add posit_bakery/registry_management/ecr/ with api.py (client wrapping the
  ecr-public describe-images/batch-delete-image API, following the GHCRClient/
  DockerhubClient shape), models.py (equivalent to GHCRPackageVersions, with
  older_than()/untagged() filtering), and clean.py (clean_registry() /
  clean_temporary_artifacts(), matching the GHCR/Docker Hub signatures).
• Match the existing registry-pattern convention used by GHCR (ghcr\.io/...) and Docker
  Hub (docker\.io/...) — add an ECR pattern (public\.ecr\.aws/..., and decide whether
  private ECR URIs need to be supported too).
• Wire ECR into bakery clean cache-registry and bakery clean temp-registry (remove the
  GHCR-only restriction, update command docstrings/help text).
• Reuse the existing default retention windows already used by clean_registry() for
  GHCR/Docker Hub (remove_tagged_older_than=80 weeks, remove_untagged_older_than=26 weeks) as the ECR defaults, overridable via the same CLI flags (--older-than,
  --untagged, etc.) already exposed for the other registries.
• Unit tests mirroring test/registry_management/ghcr/ and test/registry_management/ dockerhub/, plus CLI tests mirroring test/cli/test_clean.py.
• Confirm AWS auth/credentials handling needed for ecr-public API calls in CI (OIDC role
  permissions, region requirement — ecr-public API is us-east-1 only regardless of
  repository region).

Out of scope

• Determining what retention values any specific image should use — a per-image/consumer
  decision, tracked separately.
• Provisioning any ECR repository.

Related

• posit-dev/platform-team#457

Start by comparing posit_bakery/registry_management/ghcr/ and dockerhub/, then inspect the cleanup command implementation and test/cli/test_clean.py. Add the ECR client, models, cleanup paths, registry matching, and mirrored unit tests described in the issue. Done means both cleanup commands support ECR with the existing retention flags and CI authentication requirements are confirmed.