fix(registry): block template image publishing

[JSONbored]

Summary

• Prevent central control-check publish mode from adding registry-publish steps for template-profile repos.
• Refuse direct registry publish commands for template-profile repos.
• Keep template integration checks running without converting them into pushed registry images.

Why

unraid-aio-template is a private scaffold/template repo. It should not publish public Docker Hub images or be treated like an app repository package.

Validation

• uv run --with pytest pytest tests/test_control_plane.py::test_central_check_steps_skip_template_registry_publish tests/test_cli.py::test_registry_publish_refuses_template_profile
• trunk check --show-existing --all --no-progress --color=false
• uv run --with pytest pytest
• git diff --check

Notes

• This blocks future accidental template registry publishes. The already-pushed Docker Hub template repo/tags still need Docker Hub cleanup or visibility changes outside aio-fleet.