fix(bulker): pull the minio test container from quay, pinned

[sahiltyagi-jitsu]

Bulker Test (app) fails on every branch that actually runs it, and newjitsu is currently red for the same reason.

panic: create container: Error response from daemon: pull access denied for
minio/minio, repository does not exist or may require 'docker login'

Cause

docker.io/minio/minio is no longer publicly pullable. An anonymous pull token from auth.docker.io is rejected with UNAUTHORIZED, and Docker Hub's API has no public record of the repository. Docker's "repository does not exist or may require 'docker login'" is its generic message for an unresolvable reference — so this is not rate limiting, and adding registry credentials would not have fixed it.

Reproduced locally with the identical error:

$ docker pull minio/minio:latest
Error response from daemon: pull access denied for minio/minio, repository does
not exist or may require 'docker login'

Fix

MinIO also publish to quay.io, which is public. One line in minio_container.go.

Pinned to RELEASE.2025-09-07T16-13-09Z rather than a floating tag. That tag is multi-arch (amd64 / arm64 / ppc64le) and its manifest list is currently byte-identical to quay's :latest, so pinning costs nothing today and keeps the tests runnable on Apple Silicon. Both verified by pulling:

$ docker pull quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z     # arm64, native
Status: Downloaded newer image
$ docker pull --platform linux/amd64 quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z
Status: Downloaded newer image

There is precedent for quay in the tree — docker/docker-compose.yml:288 pulls Keycloak from it.

Why this went unnoticed for six days

The unpinned :latest meant the break needed no commit in this repo. And the bulker shard skips whenever a PR does not touch bulker/, reporting pass in ~11s — a real run takes 4-5 minutes. Recent merges (#1502, #1507, #1509, #1510) all show Bulker Test (app): pass at 11s; none of them touched bulker/.

The last real run was #1503 on 9 September. The JITSU-163 PRs were the first to exercise the suite since, which is why they surfaced it — and merging #1503 turned newjitsu red.

Worth considering separately: a scheduled run of the full suite on newjitsu would have caught this within a day instead of six.

Verification

CI on this PR is the real test — it runs the exact job that is failing. Locally the image now pulls natively on both architectures, and the previous reference reproduces the CI failure exactly.

Unblocks #1504, #1506, #1508 and the default branch.

🤖 Generated with Claude Code

[jitsu-code-review]

Reviewed the MinIO test-container image update and the surrounding S3 test setup. The pinned Quay image is publicly available and multi-architecture; the MinIO-backed file-storage test path also ran successfully with it. No actionable findings.