feat(jar): add OCI registry pull for JAR artifacts with backward compat

- Add jarRef and jarPullSecret fields to FlinkJob CRD (jarUri/basicAuth deprecated)
- OCI pull via go-containerregistry with dual auth (K8s pull secret + env vars)
- Media type validation on pulled layers
- Atomic status patches with runningJarRef/runningJarDigest tracking
- NeedsUpgrade/RunningRef/RunningRefPatchData domain helpers
- README with usage guide, pushing JARs, and GitHub Actions CI/CD workflow
- CONTEXT.md domain glossary

internal/managed_job/upgrade.go

@@ -7,10 +7,13 @@ import (
 )
 
 func (job *ManagedJob) upgrade() {
-	pkg.Logger.Info("[managed-job] [upgrade] pausing... ",
+	effectiveRef := job.def.Spec.EffectiveJarRef()
+	prevRef := job.def.Status.RunningRef()
+
+	pkg.Logger.Info("[managed-job] [upgrade] pausing...",
 		zap.String("jobName", job.def.GetName()),
-		zap.String("currentJarURI", job.def.Spec.JarURI),
-		zap.String("prevJarURI", *job.def.Status.RunningJarURI),
+		zap.String("currentRef", effectiveRef),
+		zap.String("prevRef", prevRef),
 	)
 	job.def.Status.JarId = nil
 	job.crd.Patch(job.def.UID, map[string]interface{}{
@@ -23,11 +26,10 @@ func (job *ManagedJob) upgrade() {
 		pkg.Logger.Error("[managed-job] [upgrade] error in pausing", zap.Error(err))
 		return
 	}
-	pkg.Logger.Info("[managed-job] [upgrade] restoring... ",
+	pkg.Logger.Info("[managed-job] [upgrade] restoring...",
 		zap.String("jobName", job.def.GetName()),
-		zap.String("currentJarURI", job.def.Spec.JarURI),
-		zap.String("prevJarURI", *job.def.Status.RunningJarURI),
-		zap.Error(err),
+		zap.String("currentRef", effectiveRef),
+		zap.String("prevRef", prevRef),
 	)
 
 	err = job.Run(true)