Default image pulls to GHCR and harden registry host resolution

[Copilot]

• Inspect current CI workflows and project verification commands
• Add a minimal GitHub Actions workflow to deploy/verify on Azure Kubernetes Service (AKS)
• Verify volume and ResourceCapsule functionality in the Azure workflow
• Document required Azure/GitHub secrets and how to trigger the workflow
• Re-run go test ./... and go build ./... after changes

[j143]

@copilot fix the go test issue

172.17.0.1 - - [18/Apr/2026:11:32:01 +0000] "HEAD /v2/alpine/blobs/sha256:3cb067eab609612d81b4d82ff8ad71d73482bb3059a87b642d7e14f0ed659cde HTTP/1.1" 200 0 "" "docker/28.0.4 go/go1.23.7 git-commit/6430e49 kernel/6.17.0-1010-azure os/linux arch/amd64 UpstreamClient(Docker-Client/28.0.4 \(linux\))"
172.17.0.1 - - [18/Apr/2026:11:32:01 +0000] "PUT /v2/alpine/manifests/latest HTTP/1.1" 201 0 "" "docker/28.0.4 go/go1.23.7 git-commit/6430e49 kernel/6.17.0-1010-azure os/linux arch/amd64 UpstreamClient(Docker-Client/28.0.4 \(linux\))"
Verifying the image in the local registry...
Registry catalog: {"repositories":["alpine"]}
Environment detected: inContainer=false, hasNamespacePrivileges=true, hasCgroupAccess=true, cgroupVersion=2
Fetching image 'user:password@localhost:5000/alpine' from registry...
[DEBUG] Starting to pull image 'alpine'
[DEBUG] Fetching manifest for repo 'alpine' and tag 'latest'
Error: Failed to fetch image 'user:password@localhost:5000/alpine': failed to fetch manifest: failed to fetch manifest: Get "***localhost:5000/v2/alpine/manifests/latest": http: server gave HTTP response to HTTPS client
Error: basic-docker failed to run the image.
Cleaning up...
Cleanup completed.

[Copilot]

@copilot fix the go test issue

172.17.0.1 - - [18/Apr/2026:11:32:01 +0000] "HEAD /v2/alpine/blobs/sha256:3cb067eab609612d81b4d82ff8ad71d73482bb3059a87b642d7e14f0ed659cde HTTP/1.1" 200 0 "" "docker/...

Fixed in b439617 (plus extra coverage in ab520af). resolveRegistry now strips credentials before host detection, so user:pass@localhost:5000/... is treated as a local registry and uses http://localhost:5000/v2/ instead of HTTPS. I also added tests for credentialed local registry cases (including @ in username).