Document pushing images to remote registries

[chruffins]

Layer 4 of remote registry push support (top of the stack: #348 ← #350 ← #353).

Adds user-facing docs for the outbound push feature:

• Features bullet: remote registry push with docker-style borrowed credentials
• Usage section with the docker-aligned credential model spelled out (credentials stay on the client, borrowed per push, never stored on the server; server's own logins as fallback)
• curl examples: creating a push with lent ECR credentials (the aws ecr get-login-password flow) and polling the job
• digest-preservation and ready-state notes

Docs-only; no code changes.

---

Note

Low Risk
Documentation-only change with no runtime or security behavior changes.

Overview
Documents remote registry push for cached OCI images: a new Features bullet and a Pushing Images to Remote Registries usage section.

The new section explains docker-style borrowed credentials (client-supplied per push, not stored server-side; fallback to ~/.docker/config.json), curl examples for POST /pushes (including ECR get-login-password) and polling push job status, plus notes that only ready images can be pushed and that manifest digests are preserved.

^{Reviewed by Cursor Bugbot for commit e3ebc56. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chruffins]

reviewed — accurate docs; all findings from the review are addressed in c411bbdd and 43740067 ($HYPEMAN_API_KEY in the curl examples, insecure and error-on-failure documented, ECR token hoisted, examples anchored to the real api.hostname/TLS-443 surface, and the api: config block documented).

status: all review findings addressed