fix(registry): inspect Docker Hub tags after push

[JSONbored]

Summary

• verify Docker Hub tags with docker buildx imagetools inspect before falling back to the Docker Hub API
• keep the API retry path for cases where registry inspection fails

What changed

• passes the Docker auth environment to Docker Hub tag inspection
• avoids treating Docker Hub single-tag API propagation lag as a failed publish when the registry manifest is inspectable
• updates registry tests for Docker Hub inspect-first behavior and fallback API failures

Why

The Dify publish pushed 1.14.0-aio.3 successfully, but the Docker Hub single-tag API still returned 404 during verification. The actual registry tag was live shortly after. Verification should trust the authenticated registry manifest first.

Validation

• uv run --with pytest pytest tests/test_registry.py tests/test_control_plane.py
• uv run --with pytest pytest
• trunk check --show-existing --all --no-progress --color=false