feat: Add minimum release age for image pulling #281

Adds a minimum release age policy for image pulls. When minimumReleaseAge is set, a candidate image is only eligible to be pulled once its publish time is older than the configured duration (e.g. 3d). This mitigates supply-chain attacks where an attacker pushes a malicious version and relies on it being consumed immediately, before maintainers or scanners have a chance to yank it. Defaults to 0 (disabled), preserving existing behavior.

Timestamp source. Age is computed from the registry's reported push time for the manifest digest, obtained from the registry API. The created field in the image config is not used: it is part of the image the publisher controls and can be backdated arbitrarily, which would defeat the check entirely. If the registry does not expose a push timestamp, the pull fails closed with a clear error rather than silently falling back, operators can opt out per-registry via an allowlist if they're running a registry that can't supply it.

Maybe also add a minimumReleaseAge for repositories?