feat: private registry auth for CI build images

[dlorenc]

Background

When the GCP registry auth was removed from entrypoint-worker.sh (part of #366), the baseline became: CI build images must be on public registries. This issue tracks providing a secure way to pull from private registries in CI jobs without relying on the GCP metadata server.

Problem

entrypoint-worker.sh previously fetched a ci-runner SA token from http://metadata.google.internal/ and configured ~/.docker/config.json for buildkitd. This was removed because:

• Build containers running with --oci-worker-net=host can reach the metadata server
• This gave untrusted user code access to the full ci-runner SA token

Options

1. Token broker sidecar — A privileged sidecar outside the user network namespace mints short-lived, registry-scoped tokens and serves them to buildkitd via a local socket. Build containers cannot reach the broker. Related to the token broker approach in Redesign BuildKit registry cache with per-tenant scoping and short-lived tokens #365.

2. Pre-fetched credentials before network lockdown — Fetch registry credentials before the iptables block goes up (169.254.169.254 DROP), then immediately drop the metadata server. User code starts after the block is in place and cannot fetch fresh tokens, but buildkitd already has a short-lived token cached.

3. Per-job OIDC token exchange — Worker exchanges its request_token for a short-lived Artifact Registry token via docstore API, injects it into buildkitd config before execution.

4. User-supplied registry auth in ci.yaml — Jobs declare their own registry credentials (e.g. via Workload Identity Federation using the job's OIDC token from feat: CI job OIDC identity — bind check run identities for external service authentication #283), keeping system credentials entirely out of the picture.

Related

• feat: CI job OIDC identity — bind check run identities for external service authentication #283 (job OIDC identity — user build steps can use DOCSTORE_OIDC_REQUEST_TOKEN to authenticate to GCP themselves)
• Redesign BuildKit registry cache with per-tenant scoping and short-lived tokens #365 (registry cache redesign — token broker sidecar approach overlaps)
• Eliminate all system credentials from CI worker VMs using OIDC request tokens #366 (credential elimination — this is the follow-on for private registry auth)