orchestration: use public prebuilt by default

[hugosantos]

Summary

• Use an immutable public multi-platform orchestrator image by default while retaining --orchestrator=head for source testing.
• Scope the prebuilt provisioning tool to prebuilt mode so head mode rebuilds both the server and tool.
• Use Docker credentials when publishing deploy plans and avoid requiring an unused environment registry for explicit binary repositories.

Validation

• go test ./internal/cli/cmd ./internal/build/binary ./internal/planning/deploy ./orchestration/...
• nsdev fmt
• Ran uncached nsdev prepare local --env=dev --log_actions and verified both public prebuilt references were used with no orchestrator source builds.
• Ran uncached nsdev prepare local --env=dev --orchestrator=head --log_actions and verified both the server and provisioning tool were built from source.
• Verified anonymous pulls of the pinned amd64/arm64 server, provisioning tool, and migrated filesync prebuilt from public.registry.namespace.systems.