docs: replace stale container image mirroring workflow

[dholt]

Summary

• replace the stale container-replicator workflow with a Skopeo dir: transport that preserves Docker manifest-list bytes and digests on Skopeo 1.22.2
• preserve multi-architecture images and require source-to-destination digest equality after the offline registry import
• retain a Docker pull/save/load fallback for single-platform images and document its architecture boundary
• keep credentials in temporary auth directories, require separately retained checksum/digest trust anchors, and create transfer ISOs unprivileged with strict shell failure handling
• separate the loopback-only test registry from the production TLS, authentication, reachability, and push/pull acceptance checklist

Validation

• git diff --check origin/master...HEAD
• all 11 Bash examples pass bash -n
• public sanitizer pass on the PR body, full diff, and changed documentation
• live reproduction with Skopeo 1.22.2 confirmed oci: plus --all --preserve-digests fails for the documented CUDA manifest list; the corrected dir: transport preserves the source digest
• independent technical/security and field-operator review findings addressed

Notes

• the documented OCI transport limitation is scoped to Skopeo 1.22.2 and the tested Docker-media-type multi-architecture source
• the production path requires checksum and digest trust anchors retained separately from the transfer media
• the Skopeo path requires exact digest equality after the round trip; an archive checksum alone is not considered sufficient