feat(jar): add OCI registry pull for JAR artifacts with backward compat

- Add jarRef and jarPullSecret fields to FlinkJob CRD (jarUri/basicAuth deprecated)
- OCI pull via go-containerregistry with dual auth (K8s pull secret + env vars)
- Media type validation on pulled layers
- Atomic status patches with runningJarRef/runningJarDigest tracking
- NeedsUpgrade/RunningRef/RunningRefPatchData domain helpers
- README with usage guide, pushing JARs, and GitHub Actions CI/CD workflow
- CONTEXT.md domain glossary

CONTEXT.md

@@ -0,0 +1,41 @@
+# Flink Kube Operator
+
+Kubernetes operator that manages the lifecycle of Apache Flink jobs via CRDs.
+
+## Language
+
+**FlinkJob**:
+A Kubernetes Custom Resource representing a desired Flink job. Contains spec (desired state) and status (observed state).
+_Avoid_: Job CR, CRD instance
+
+**ManagedJob**:
+Runtime wrapper that drives a FlinkJob's lifecycle through its state machine (init → run → savepoint → upgrade).
+_Avoid_: Job controller, job runner
+
+**jarRef**:
+Full OCI reference identifying a JAR artifact in a registry (e.g. `registry.io/org/app:1.0.0`).
+_Avoid_: jarUri, jar URL, artifact URL
+
+**jarDigest**:
+SHA256 content hash of the JAR layer in the OCI manifest. Immutable identifier for the artifact bytes.
+_Avoid_: content hash, checksum
+
+**pullSecret**:
+A `kubernetes.io/dockerconfigjson` Kubernetes Secret containing registry credentials, referenced by name in the FlinkJob spec.
+_Avoid_: imagePullSecret, registry secret
+
+**JarFile**:
+Ephemeral artifact handle — a downloaded/pulled JAR on local disk awaiting upload to Flink, then deleted.
+_Avoid_: temp jar, local jar
+
+**LifeCycleStatus**:
+Operator-managed lifecycle state of a FlinkJob (HEALTHY, RESTORING, GRACEFULLY_PAUSED, FAILED, etc.).
+_Avoid_: operator status, lifecycle state
+
+**JobStatus**:
+Flink-reported job state (RUNNING, FAILED, FINISHED, etc.). Mirrored from the Flink REST API.
+_Avoid_: flink status, job state
+
+**Savepoint**:
+A consistent snapshot of a Flink job's state, used for restart and upgrade.
+_Avoid_: checkpoint, snapshot