Remap all sidecar images across Docker and Kubernetes

[warp-agent-staging]

Allow self-hosted workers to redirect every sidecar image to an operator registry on Docker and Kubernetes. This covers the main agent, coding-agent CLIs/ACP adapters, computer use, and future additional sidecars.

Implements REMOTE-3571.

What changed

• Add backend.docker.sidecar_image_mappings and backend.kubernetes.sidecar_image_mappings, with Helm's kubernetesBackend.sidecarImageMappings equivalent.
• Match normalized source repositories without tags/digests. Unpinned destinations retain the assigned tag/digest; pinned destinations replace the version entirely, as requested when mirrors do not contain every server-selected tag.
• Apply mappings once to assigned sidecars, preserving order and mount options. Leave task, preflight, and pod-template service images unchanged.
• Compile legacy sidecar_image and Kubernetes coding_cli_sidecars into mappings for official Warp agent and harness CLI/ACP repositories. Reject combining legacy options with explicit mappings. Legacy options no longer inject absent sidecars or override arbitrary source images by mount path; this compatibility change keeps one runtime resolution path.
• Use the existing Docker credential configuration for destination-registry sidecar pulls. Kubernetes continues to use pod-template imagePullSecrets.
• Reject malformed references, versioned source keys, and duplicate normalized source repositories before worker/backend startup.

Operators must keep mirrored versions available and ensure pinned images remain compatible with the server and agent.

Validation

• GOMAXPROCS=2 go test -p 2 ./... -count=1 passed.
• go vet ./..., go build ./..., and golangci-lint run passed (0 issues); changed Go files formatted with gofmt.
• Helm 4.1.3 lint and default/custom renders passed.
• Fake Docker Engine requests verify mapped pull references, destination credentials, and mounts. Fake Kubernetes Job creation verifies init-copy and native image-volume references. No live Docker daemon, Kubernetes cluster, or UI verification was used.

Plans:

• Repair PR #173 Kubernetes test integration with main

[warp-agent-staging]

This PR was generated with Warp.

Comment @warp-staging-factory on this PR to send it follow-up work.