feat(jar): add OCI registry pull for JAR artifacts with backward compat

- Add jarRef and jarPullSecret fields to FlinkJob CRD (jarUri/basicAuth deprecated)
- OCI pull via go-containerregistry with dual auth (K8s pull secret + env vars)
- Media type validation on pulled layers
- Atomic status patches with runningJarRef/runningJarDigest tracking
- NeedsUpgrade/RunningRef/RunningRefPatchData domain helpers
- README with usage guide, pushing JARs, and GitHub Actions CI/CD workflow
- CONTEXT.md domain glossary

example-job.yaml

@@ -8,9 +8,8 @@ spec:
   name: "Word Count Example"
   entryClass: "tech.logicamp.logiline.FacilityEnrichment"
   parallelism: 1
-  jarUri: "https://git.logicamp.tech/api/packages/logiline/generic/facility-enrichment/1.0.0/facility-enrichment.jar"
-  jarURIBasicAuthUsername: logiline-actrunner
-  jarURIBasicAuthPassword: daeweeb7ohpaiw3oojiCoong
+  jarRef: "lcr.logicamp.tech/logiline/facility-enrichment:1.0.0"
+  jarPullSecret: "lcr-registry-creds"
   # args accepts two formats:
   #   Map (recommended):
   args:
@@ -24,4 +23,4 @@ spec:
   #     - batch-sales-config-dedup-processor
   flinkConfiguration:
     taskmanager.numberOfTaskSlots: "1"
-    parallelism.default: "1"
+    parallelism.default: "1"