Validate image.source: registry requires a tag; discourage tag: latest

[RonaldHensbergen]

Part of #407, depends on #532 (renderer mechanism must land first so there's a configSchema shape to validate against).

Scope

1. In cli/validator.py, add a check: when a module instance's resolved config.image.source == "registry", config.image.tag must be a non-empty string. Emit a new diagnostic error code (next available E1xx) if missing.
2. Add a warning (not an error) when config.image.tag == "latest" under source: registry, nudging toward pinned, reproducible versions per Allow modules to pull published images instead of always building locally #407's stated goal (matching the version scheme already used by .github/workflows/publish-images.yml, simplified in Remove date suffix from Docker Hub published image tags #405).
3. Document the new error/warning code in README.md's error-code reference (matching the existing table style, e.g. how E103–E106 were documented for Profile composition: support layered/extended profiles to reduce duplication #175).
4. Unit tests in tests/test_validator.py: missing tag under source: registry (error), tag: latest (warning present but profile still validates), and the source: build default path unaffected.

Relationship

Parent issue: #407. Depends on #532.