Plan for cleaning up legacy images on docker.io/stellar/stellar-cli

Start with builds.json and the current pipeline to determine which Docker Hub tags and digests are officially produced, then inventory docker.io/stellar/stellar-cli. Review the README for where the publication policy should be documented. Done means the legacy-image disposition, test repository, and ongoing cleanup policy are agreed and recorded.

What problem does your feature solve?

The docker.io/stellar/stellar-cli Docker Hub repository contains images that were published before this repo's pipeline existed. Those legacy images were not produced by the current builds.json-driven, digest-pinned pipeline, so they don't share its provenance, reproducibility, or pinning guarantees.

Leaving them in place creates a few problems:

• Users (and SEP-58 verifiers) can pull tags that look official but were not produced by the documented pipeline.
• The published tag/digest list no longer matches what builds.json says we publish, making the repo's source of truth misleading.
• Ad-hoc/test pushes during pipeline development pollute the same namespace users consume from.

What would you like to see?

A plan with the following rough shape — exact details to be worked out in the issue/PR:

1. Inventory every tag and digest currently on docker.io/stellar/stellar-cli and classify each as:
   • produced by the current pipeline (matches an entry in builds.json), or
   • legacy / not produced by the current pipeline.
2. Remove (or otherwise retire — e.g. deprecate, hide, retag-and-archive) any images not produced by the current pipeline. Decide whether deletion is acceptable or whether we need a deprecation window first, given that downstream users and SEP-58 bldimg references may pin those digests.
3. Stop using stellar/stellar-cli as a test target. Pick a separate Docker Hub repo (e.g. stellar/stellar-cli-test or similar) for pipeline development and CI dry-runs, so the user-facing repo only ever receives pipeline-produced releases.
4. Document the policy in this repo's README so future maintainers don't re-pollute the production namespace.