feat(jar): add OCI registry pull for JAR artifacts with backward compat

- Add jarRef and jarPullSecret fields to FlinkJob CRD (jarUri/basicAuth deprecated)
- OCI pull via go-containerregistry with dual auth (K8s pull secret + env vars)
- Media type validation on pulled layers
- Atomic status patches with runningJarRef/runningJarDigest tracking
- NeedsUpgrade/RunningRef/RunningRefPatchData domain helpers
- README with usage guide, pushing JARs, and GitHub Actions CI/CD workflow
- CONTEXT.md domain glossary

crds.yaml

@@ -24,7 +24,6 @@ spec:
               type: object
               required:
                 - key
-                - jarUri
               properties:
                 key:
                   type: string
@@ -37,12 +36,21 @@ spec:
                   type: string
                 parallelism:
                   type: integer
+                jarRef:
+                  type: string
+                  description: "OCI reference to the JAR artifact (e.g. registry.io/org/app:tag). Takes precedence over jarUri."
+                jarPullSecret:
+                  type: string
+                  description: "Name of a kubernetes.io/dockerconfigjson Secret for registry authentication."
                 jarUri:
                   type: string
+                  description: "Deprecated. Use jarRef instead. HTTP(S) URL to the JAR file."
                 jarURIBasicAuthUsername:
                   type: string
+                  description: "Deprecated. Use jarPullSecret instead."
                 jarURIBasicAuthPassword:
                   type: string
+                  description: "Deprecated. Use jarPullSecret instead."
                 args:
                   description: "Program arguments. Accepts a list of strings (--key, value, ...) or a map of key-value pairs."
                   x-kubernetes-preserve-unknown-fields: true
@@ -98,8 +106,15 @@ spec:
                 lastRestoredSavepointRestoredDate:
                   type: string
                   format: time
+                runningJarDigest:
+                  type: string
+                  description: "SHA256 digest of the currently running JAR layer."
+                runningJarRef:
+                  type: string
+                  description: "OCI reference of the currently running JAR."
                 runningJarURI:
                   type: string
+                  description: "Deprecated. HTTP URI of the currently running JAR."
                 pauseSavepointTriggerId:
                   type: string
                 restoredCount: