Acquire private images without persistent registry credentials

For a user-owned Compose host, stream a package-read credential over encrypted transport into registry login via stdin using a fresh mode-restricted temporary Docker config. Pull and verify the immutable digest and source revision, then logout and delete that exact config in a trap before runtime replacement. Recreate with no build and no pull; keep the prior directory and cached rollback image untouched. Root or a compromised same-user process may still read the temporary config, so durable automation should use a scoped machine credential.