feat(#585): re-home all images onto a private mirror via global.imageRegistry

[shujaatTracebloc]

What & why

Restricted-network / air-gapped installs can now point every image the chart
pulls at a private registry mirror with a single knob, following the standard
global.imageRegistry convention. This is the mechanism for both the
"reachable private mirror" and the "fully air-gapped internal registry" cases
the preflight check (#601) directs operators toward.

Contributes to #585.

Chart

• global.imageRegistry re-homes all images: tracebloc/*, the spawned
  ingestor (INGESTOR_IMAGE_REPOSITORY), the training-job image host
  (JOB_IMAGE_HOST), and the alpine/*, ubuntu/squid, busybox, curl
  helper images. New tracebloc.mirrorPrefix helper for the registry-less
  utility images.
• Precedence: an explicit images.ingestor.repository still wins; an
  explicit per-image registry is overridden by the global mirror (Bitnami
  semantics).
• Byte-identical default: empty/unset renders exactly as before
  (docker.io / ghcr.io, alpine/* unprefixed). An empty
  global.imageRegistry is hardened so JOB_IMAGE_HOST never degrades to /.
• Documented global.imageRegistry in values.yaml.

Installer (one knob)

• TRACEBLOC_IMAGE_REGISTRY writes global.imageRegistry into the generated
  values.
• TRACEBLOC_REGISTRY_USERNAME / TRACEBLOC_REGISTRY_PASSWORD (optional
  TRACEBLOC_REGISTRY_SERVER, TRACEBLOC_REGISTRY_EMAIL) mint the chart's
  imagePullSecret; the pull-secret server is derived as https://<host>
  (the chart schema requires a URI, while global.imageRegistry is a bare host).
• Bash _image_mirror_yaml and PowerShell Get-ImageMirrorYaml are at parity
  and were verified end-to-end through helm template (images re-homed, pull
  secret rendered, YAML single-quote escaping correct).

Docs

• Rewrote the "Blocked container registry (mirror / air-gapped)" section in
  docs/INSTALL.md. The previous per-image images.<name>.registry override it
  documented was a no-op against the current chart; the section now shows the
  working global.imageRegistry knob (installer env var + plain-Helm forms) and
  a command to enumerate exactly which images to mirror.

Tests

• helm-unittest: new global_image_registry_test.yaml (15 cases — mirror
  re-homing per template, byte-identical defaults, precedence guards).
• bats: 7 cases for _image_mirror_yaml.
• Pester: 7 cases for Get-ImageMirrorYaml.
• Full suites green locally (helm-unittest 340 pass, Pester 427 pass); no new
  failures (the 4 pre-existing helm-unittest schema-negative failures are
  unrelated and also fail on develop).

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes every image reference and runtime-spawned job pull paths; misconfiguration can break pulls cluster-wide, though unset mirror preserves prior defaults.

Overview
Adds global.imageRegistry (Bitnami-style) so restricted-network and air-gapped installs can point every chart image at one private mirror with a single value. Chart 1.9.14.

Chart: New tracebloc.mirrorPrefix for registry-less utility images (alpine/*). tracebloc.image call sites and CronJob image lines now use global.imageRegistry where applicable. jobs-manager gets dynamic INGESTOR_IMAGE_REPOSITORY (mirror re-homes default ghcr.io/tracebloc/ingestor unless images.ingestor.repository is set) and JOB_IMAGE_HOST (was hardcoded docker.io/). Egress squid registry precedence: global mirror wins; empty global.imageRegistry still falls through to per-image registry via | default.

Installers:TRACEBLOC_IMAGE_REGISTRY (and optional registry creds) emit mirror YAML in bash _image_mirror_yaml and PowerShell Get-ImageMirrorYaml, wired into generated values.

Docs:INSTALL.md mirror section documents the single knob and drops the old per-image override pattern that did not match the chart.

Tests: Helm unittest suite global_image_registry_test.yaml, plus bats/Pester for mirror YAML helpers.

^{Reviewed by Cursor Bugbot for commit d0a8035. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1e090ef. Configure here.}

[saadqbal]

Please make sure any change is backward compatible.