fix(dind): widen insecure-registries to cover Kubernetes service CIDR (iac#82)

[brandonrc]

Summary

Closes iac#82.

The DinD daemon.json on ARC runners listed only the dogfood Docker Hub cache as an insecure-registries entry. Ephemeral test-namespace backends at artifact-keeper-backend.test-\${RUN_ID}.svc.cluster.local:8080 fell outside that allowlist, so dockerd refused plain-HTTP push/pull to them.

Concrete impact: artifact-keeper-test#52's test-docker-native-client.sh pre-flight-skipped on every CI run with "dockerd has no insecure-registries entry". With `RELEASE_GATE=1` (set in PR #52 round 3), that skip turns into a hard fail.

Fix

Added Rocky's Kubernetes service CIDR (`10.96.0.0/12`) to insecure-registries. dockerd does not support hostname wildcards (no `*.svc.cluster.local`), but it does support CIDR for IPs. The service network covers every in-cluster Service ClusterIP.

Risk

In-cluster-only. The Kubernetes service network is not routable from outside the cluster, so this widens the allowlist to ports/services that are already exposed to in-cluster pods anyway. No new attack surface.

Verification

Configmap already applied live on Rocky. Verified:

```
$ kubectl -n arc-runners get configmap dind-registry-mirror -o jsonpath='{.data.daemon\.json}'
{
"registry-mirrors": [...],
"insecure-registries": [
"ak-cache-artifact-keeper-backend.infra-registry-cache.svc.cluster.local:8080",
"10.96.0.0/12"
]
}
```

Existing runner pods keep the old daemon.json until they respawn (post-current-job); new pods pick up the widened allowlist immediately.

Test Checklist

• Helm template renders without errors -- N/A (kubectl apply)
• Terraform validates/plans cleanly -- N/A
• Manually verified on staging cluster (live cluster running this config)
• Rollback strategy documented (revert commit, kubectl apply old configmap)

Infrastructure

• Helm: `helm template` renders correctly -- N/A
• Terraform: `terraform validate` passes -- N/A
• Terraform: `terraform plan` shows expected changes -- N/A
• ArgoCD: Application manifests are valid (kubectl-applied configmap is unchanged shape)
• N/A - documentation only

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud