feat(agent): add --plain-http for a registry without TLS (MK8S-445)

[ezekiel-alexrod]

Component

agent, docs

Problem

The MetalK8s registry serves plain HTTP. go-containerregistry only falls back to HTTP for a loopback or private address, so a registry reached by host name or public IP can't be pulled from. That breaks the join on a node (MK8S-394) and the resources created at bootstrap (MK8S-396).

Fix

Stacked on #26, so the diff here is the last commit only. I'd mostly like eyes on the scheme note in agent/DESIGN.md ("Pulling and extraction") and on open in agent/internal/puller/puller.go.

• The manager and imagecachectl import take --plain-http. It marks the registry insecure (name.Insecure), which is the library's own switch for this.
• The library still tries HTTPS first. It also tries HTTP when HTTPS fails or takes more than 300ms, and the first answer wins. So with the flag, a certificate error on an HTTPS registry no longer fails the pull. agent/DESIGN.md says it.
• Off by default, no manifest sets it. The agent logs a warning at startup, the command prints one before it pulls (not for an archive).
• It excludes --ca-file and --insecure-skip-tls-verify: it's for a registry without TLS, so a certificate setting next to it is a mistake.

Test

Check	Result
go test -race ./... with envtest, go vet, golangci-lint after cache clean (Go 1.26.0)	OK
HTTP registry reached by host name: refused without the flag (HTTP response to HTTPS client), pulled with it, in puller and through imagecachectl import	OK
HTTPS registry pulled with the flag set	OK
Flag combined with --ca-file or --insecure-skip-tls-verify	refused: imagecachectl names both flags, the manager exits on ErrTLS
make -C agent test-e2e on kind	OK, but it doesn't set the flag
RPM tests	not run, the RPM isn't touched

Out of scope

• A per-registry list instead of a global flag. MetalK8s pulls from its own registry only, so one flag is enough today. A site mixing an HTTP registry and one signed by a private CA can't be served until then.
• Setting the flag from MetalK8s: MK8S-394 and MK8S-396.

---

• The docs describing this behaviour are updated in the same pull request: README.md, agent/README.md, DESIGN.md, agent/DESIGN.md, CONTRIBUTING.md, whichever owns it.
• A change to the cache directory layout (subdirectory scheme, archive names, sentinel, permissions) lands in both halves and in agent/DESIGN.md. Not applicable.

Relates-to: MK8S-445

[claude]

name.Insecure is applied to every reference, so the flag lets plain HTTP reach every registry. Once ping.go races the two schemes (pingParallel, 300ms fallbackDelay in go-containerregistry v0.21.7), anyone on the path can answer the HTTP attempt for a registry that serves HTTPS. agent/DESIGN.md documents this instead of fixing it. A small fix: take the host instead of a bool (--plain-http=<registry>, or a list), and add name.Insecure only when the reference's registry matches it. MetalK8s only needs its own registry, so the global form buys nothing. If you keep the global flag on purpose, the deferral belongs in the commit message: today it is only in the PR body.