Onboard off public-images GitLab job-token trigger

[AliDatadog]

Summary

DataDog/public-images is a GitHub repo synced to GitLab. Historically, repos publish public container images by triggering it directly through a legacy GitLab trigger: project: DataDog/public-images job (implicit GitLab job-token authorization). We're migrating off that mechanism in favor of a dd-pkg publish-image CLI call against the artifact-gateway service, which internally still drives the same public-images pipeline but goes through a policy/audit layer instead of relying on bare CI job-token trust.

This is a CI-YAML-only change: no per-repo registration or allowlist step is required on the artifact-gateway side, since authorization is implicit via CI job identity.

This PR converts all 7 jobs in .gitlab-ci.yml that used the direct trigger: project: DataDog/public-images mechanism:

• trigger_e2e_operator_image
• publish_public_main
• publish_public_tag
• publish_redhat_public_tag
• publish_public_latest
• publish_public_rc_latest
• publish_redhat_public_latest

Each job's own stage, rules, needs, and variables (e.g. IMG_SOURCES/IMG_DESTINATIONS/IMG_REGISTRIES) are unchanged — only the trigger mechanism itself is swapped, via a new shared .docker_publish_job_definition template that all 7 jobs now extends.

More context: https://datadoghq.atlassian.net/wiki/x/ooQkngE
Jira: https://datadoghq.atlassian.net/browse/BARX-1948

Test plan

• ruby -ryaml -e "YAML.unsafe_load_file('.gitlab-ci.yml'); puts 'OK'" — YAML parses successfully
• GitLab pipeline runs green on this branch (publish jobs are release-gated/manual, so full exercise happens on a tagged release or main merge)

[datadog-datadog-prod-us1-2]

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 47.25% (+0.00%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 41e9f98 | Docs | Datadog PR Page | Give us feedback!}