Acquire private images without persistent registry credentials
For a user-owned Compose host, stream a package-read credential over encrypted transport into registry login via stdin using a fresh mode-restricted temporary Docker config. Pull and verify the immutable digest and source revision, then logout and delete that exact config in a tr…