fix(kind): route docker.io through mirror.gcr.io to dodge Docker Hub 429s

[yoavkatz]

Problem

Docker Hub's anonymous pull rate limit (100 pulls / 6 h, per IP) trips a
429 Too Many Requests on the kind node's base-image pulls — most visibly the
busybox:1.36 init containers, which land in Init:ErrImagePull and stall a
run. With no Docker Hub account on the machine, docker login (which only raises
the ceiling to 200/6 h anyway) isn't a fix.

Change

Route docker.io through mirror.gcr.io, Google's public pull-through cache
of Docker Hub — no account, no rate limit. This is transparent: image
references stay literally busybox:1.36 / python:3.12-slim; only the source of
the bytes moves. Because the digests served are identical, an image's build-input
hash is unchanged, so this does not perturb release build-input hashing.

• deploy/kind/create.sh — create_cluster() now emits a
  containerdConfigPatches block setting
  config_path = "/etc/containerd/certs.d", then writes a docker.io
hosts.toml drop-in into the node after kind create cluster, pointing at
  mirror.gcr.io with capabilities = ["pull", "resolve"]. A fresh cluster (or
  --recreate) picks it up.
• docs/guides/podman-on-apple-silicon.md — the existing "Docker Hub rate
  limits (429)" section now documents the durable mirror approach for both
  toolchains (node containerd via create.sh, and the podman machine's
  registries.conf for host-side builds), keeping the ECR public-mirror retag as
  the quick one-off.

No Dockerfile / manifest / preset FROM/image: lines are touched — the
transparent mirror covers every docker.io reference at once, and the pinned
docker.io/... vendor and per-task images resolve through it unchanged.

Scope & rules

Code + docs only; no rule (.agents/) changes — satisfies contributing
principle 2 (rules-or-code, not both). Checked against:

• .agents/delivery/RULES.md — principles 11/12/14 (build inputs & recorded
  hashes): a transparent mirror changes byte source, not image refs or digests,
  so build-input hashing and "fail dirty" are unaffected.
• .agents/docs/RULES.md — the guide edit is explanatory, common-path-first,
  runnable commands, no RFC 2119 keywords, no doctrine restatement.

Verification

• podman pull python:3.12-slim and busybox:1.36 resolve via the mirror with
  no 429 (host path).
• docker buildx bake of a FROM python:3.12-slim target pulls through the
  mirror and loads locally, once the BuildKit builder carries the same mirror
  config (documented separately; machine-local, not in this PR).
• bash -n and the repo's shellcheck pre-commit hook (--severity=warning)
  pass on create.sh.

The currently-running dev cluster is intentionally left untouched (no live
containerd restart); the mirror takes effect on the next --recreate.

🤖 Generated with Claude Code