feat(jar): add OCI registry pull for JAR artifacts with backward compat

- Add jarRef and jarPullSecret fields to FlinkJob CRD (jarUri/basicAuth deprecated)
- OCI pull via go-containerregistry with dual auth (K8s pull secret + env vars)
- Media type validation on pulled layers
- Atomic status patches with runningJarRef/runningJarDigest tracking
- NeedsUpgrade/RunningRef/RunningRefPatchData domain helpers
- README with usage guide, pushing JARs, and GitHub Actions CI/CD workflow
- CONTEXT.md domain glossary

internal/managed_job/run.go

@@ -83,17 +83,21 @@ func (job *ManagedJob) Run(restoreMode bool) error {
 	// job.def.Status.JobId = &runJarResp.JobId
 	// job.def.Status.JobStatus = v1alpha1.JobStatusCreating
 	// job.def.Status.Error = nil
+	statusPatch := map[string]interface{}{
+		"jobId":                             jobId,
+		"jobStatus":                         v1alpha1.JobStatusCreating,
+		"lifeCycleStatus":                   v1alpha1.LifeCycleStatusRestoring,
+		"lastRestoredSavepointDate":         job.def.Status.LastSavepointDate,
+		"restoredCount":                     job.def.Status.RestoredCount + 1,
+		"lastRestoredSavepointRestoredDate": time.Now().Format(time.RFC3339),
+		"error":                             nil,
+	}
+
+	refKey, refVal := job.def.Spec.RunningRefPatchData()
+	statusPatch[refKey] = refVal
+
 	job.crd.Patch(job.def.UID, map[string]interface{}{
-		"status": map[string]interface{}{
-			"jobId":                             jobId,
-			"runningJarURI":                     job.def.Spec.JarURI,
-			"jobStatus":                         v1alpha1.JobStatusCreating,
-			"lifeCycleStatus":                   v1alpha1.LifeCycleStatusRestoring,
-			"lastRestoredSavepointDate":         job.def.Status.LastSavepointDate,
-			"restoredCount":                     job.def.Status.RestoredCount + 1,
-			"lastRestoredSavepointRestoredDate": time.Now().Format(time.RFC3339),
-			"error":                             nil,
-		},
+		"status": statusPatch,
 	})
 
 	return nil