feat(jar): add OCI registry pull for JAR artifacts with backward compat

- Add jarRef and jarPullSecret fields to FlinkJob CRD (jarUri/basicAuth deprecated)
- OCI pull via go-containerregistry with dual auth (K8s pull secret + env vars)
- Media type validation on pulled layers
- Atomic status patches with runningJarRef/runningJarDigest tracking
- NeedsUpgrade/RunningRef/RunningRefPatchData domain helpers
- README with usage guide, pushing JARs, and GitHub Actions CI/CD workflow
- CONTEXT.md domain glossary

internal/managed_job/cycle.go

@@ -10,8 +10,6 @@ import (
 )
 
 func (job *ManagedJob) Cycle() {
-	// pkg.Logger.Debug("[managed-job] [new] check cycle", zap.String("jobName", job.def.GetName()))
-
 	// Init job
 	if job.def.Status.LifeCycleStatus == "" && (job.def.Status.JobStatus == "" || job.def.Status.JobStatus == v1alpha1.JobStatusFinished) {
 		job.Run(false)
@@ -26,7 +24,8 @@ func (job *ManagedJob) Cycle() {
 				job.trackSavepoint()
 			}
 		}
-		if job.def.Status.RunningJarURI != nil && job.def.Spec.JarURI != *job.def.Status.RunningJarURI {
+
+		if job.def.Spec.NeedsUpgrade(job.def.Status) {
 			job.upgrade()
 		}
 
@@ -42,14 +41,6 @@ func (job *ManagedJob) Cycle() {
 		job.crd.SetJobStatus(job.def.UID, job.def.Status)
 		return
 	}
-	// if job.def.Status.JobStatus == v1alpha1.JobStatusFailed && job.def.Status.LastSavepointPath != nil {
-	// 	//job.restore()
-	// 	return
-	// }
-	// if job.def.Status.JobStatus == v1alpha1.JobStatusFailed && job.def.Status.LastSavepointPath == nil {
-	// 	//job.restore()
-	// 	return
-	// }
 
 	pkg.Logger.Warn("[managed-job] [cycle] unhandled job status", zap.String("name", job.def.Name), zap.String("status", string(job.def.Status.JobStatus)), zap.String("namespace", job.def.Namespace))
 }