Raise TaskResourceNotFound instead of bare DoesNotExist in tasks

[wussh]

Summary

• pulpcore's task executor treats any task exception that isn't a PulpException subclass as deprecated: it logs a pulpcore.deprecation warning today and will sanitize the message away entirely in pulpcore 3.130.
• Every task that looks up its arguments' referenced objects by pk (repository, remote, manifest, signing service, artifact, ...) raises a bare Django DoesNotExist when that object was deleted between dispatch and execution. This is non-deterministic — a different one surfaces on each CI run depending on test/teardown timing (observed both ManifestSigningService and ContainerDistribution DoesNotExist warnings on unrelated PRs' CI, e.g. Fix tag-based manifest pulls 404ing while digest-based pulls succeed #2438).
• Adds TaskResourceNotFound(PulpException) and a get_task_resource_or_raise() helper (app/utils.py), used at the top-of-task object lookups in tag.py, untag.py, recursive_add.py, recursive_remove.py, synchronize.py, download_image_data.py, sign.py, and builder.py.
• Left the intentional try/except DoesNotExist in builder.py's get_or_create_blob alone — that's expected control flow (create-on-miss), not an unhandled lookup failure.
• Also pulled in two related, independently-discovered deprecations-noise fixes so this PR is self-contained (same root cause class — non-PulpException raised in a task — found while chasing Domain-scoped container registry: tag-based manifest fetch 404s, digest-based works (pulpcore 3.113.0 / pulp_container 2.28.0) #2417's CI): builder.py's podman build/push failure now raises ContainerBuildError(PulpException) instead of bare Exception, and test_domains.py's cdomain_factory fixture now cleans up ContainerNamespace (a PROTECT FK to Domain) before teardown deletes the domain, instead of leaving it to raise ProtectedError.

Not addressed (out of scope for this PR): pulpcore's own generic tasks (e.g. general_multi_delete, which can raise ContainerDistribution.DoesNotExist) are outside pulp_container's control, so the deprecations CI job may still show occasional pulpcore-origin warnings even after this merges. This is a noise-reduction / forward-compat cleanup for pulp_container's own task code, not a guarantee of a fully green deprecations job.

Test plan

• ruff check / ruff format --check clean on all touched files.
• Verified by grep that no other unhandled Model.objects.get(pk=...) task-entry lookups were missed in app/tasks/.
• CI (lint/build/test/docs/sanity/ready-to-ship) — all green; deprecations job re-checked, remaining warnings confirmed unrelated to this PR's changes.

[gerrod3]

Not sold on the retrieve or raise logic/exception. The other builder exception looks good.

[jobselko]

@wussh I see this PR duplicates some code from #2438. It would be helpful to put those changes in a separate commit and clearly mark them to make the PR easier to review.

[wussh]

Addressed:

• error_codes renamed to the CON00XX convention: TaskResourceNotFound -> CON0001, ContainerBuildError -> CON0002.
• Changelog fragments now use single backticks (markdown).
• cdomain_factory now uses @gerrod3's version of the namespace cleanup from Fix 404 on tag fetch due to overly strict Accept header matching #2424 (suppress + monitor_task) instead of mine.

@jobselko the duplicated ContainerBuildError/cdomain_factory changes from #2438 are already in their own separate commits (Raise ContainerBuildError instead of bare Exception in image builder, Clean up ContainerNamespace before domain deletion in domain tests) — let me know if you'd like them called out any more clearly than that.

@gerrod3 re: "not sold on the retrieve or raise logic/exception" — could you elaborate on what you'd prefer instead? Happy to rework get_task_resource_or_raise once I understand the concern.