feat(renderer): image.source build|registry mechanism (#532)

[RonaldHensbergen]

Summary

Implements the core renderer mechanism from #407, scoped per #532: a per-module image.source config (build | registry, default build) that lets a rendered Compose service pull an already-published image instead of building locally.

• modules/orchestration/dagster/module.yaml: added image.source (enum build/registry, default build) and image.tag (string) to configSchema, alongside the existing image.variant.
• cli/renderer.py: new _apply_image_source() step in _render_services(). When config.image.source == "registry" and config.image.tag is set, drops the service's build: block and rewrites image: to docker.io/ronaldsoeverein/cds-dagster:<tag>. Services without a build: block are untouched. If source: registry but no tag is set, falls back to the existing build behavior (never emits an untagged registry ref).
• tests/test_renderer.py: new ImageSourceRenderingTest covering default build behavior (regression), registry+tag rewrite, registry without tag fallback, services without build left alone, and variant-prefixed tags (e.g. hardened-1.8.0).

Out of scope (tracked separately)

• Validator enforcement that tag is required when source: registry, and discouraging tag: latest — Validate image.source: registry requires a tag; discourage tag: latest #533
• Superset adoption — Adopt image.source in modules/bi/superset/module.yaml #534
• Docs — Document image.source (build|registry) in docs/modules.md and README #535

Resolves #532

Testing

• python -m unittest discover -s tests -p "test_*.py" -v — 556 tests, all pass
• make lint — passes
• cds validate profiles/local-dagster-postgres-superset/profile.yaml — still valid