[deckhouse-cli] add proxy registry handle

[ldmonster]

Summary

Adds --proxy-registry flag to d8 mirror pull for pulling Deckhouse bundles from proxy/caching registries that serve individual manifests fine but refuse the registry catalog API (ListTags). Without this flag those registries return an empty tag list and the resulting bundle is empty even when the cache already holds the desired releases.

Problem

The default discovery flow calls ListTags on three repository paths to find versions to mirror:

1. The platform release-channel repo — to enumerate platform release tags.
2. The modules root — to enumerate the module catalog (which modules exist).
3. Per-module repos — to enumerate each module's version history.

A caching/transparent proxy registry typically rejects all three with an empty response or a 404. Any attempt to pull from such a registry with the current code produces an empty bundle.

Solution

• New flag --proxy-registry replaces the three ListTags calls with a forward-probe walk over semver tags:

  • Starts from the lowest version literal named in --include-platform / --include-module@<constraint>.
  • Increments patch by 1 each step, issuing a manifest HEAD request (CheckImageExists) per candidate.
  • When a patch series ends (404), jumps to the next minor (M, m+1, 0) and probes once; if that also fails, jumps to the next major (M+1, 0, 0); if that fails too, terminates.
  • Only versions the registry actually confirms are included; the upstream latest-patch-per-minor / inclusive-anchor logic is applied identically to the result.
  • Module names are taken directly from the --include-module whitelist — the "list what modules exist" catalog call is skipped entirely.

• Validation ensures sane flag combinations:

  • Requires --include-platform when platform is being pulled (omit with --no-platform).
  • Requires --include-module <name>@<constraint> (with explicit version) for every module; bare --include-module foo is rejected since it would start probing from v0.0.0.
  • Conflicts with --deckhouse-tag (single-tag pulls don't need a probe) and --since-version (no upper bound → probe can't terminate).
  • --exclude-module, --no-platform, --no-modules, --dry-run are all honoured.

Changed files

File	Change
modules/constraints.go	SemanticVersionConstraint.LowerBound() — extracts the lowest semver literal from a constraint string; used as the probe's seed
modules/probe.go	New ProbeAvailableVersions function — generic semver forward-probe walk with a pluggable ProbeChecker function
modules/filter.go	Filter.IsWhitelist(), Filter.ModuleNames() — helpers for the proxy-mode module discovery path
modules/modules.go	discoverModuleNames, listTagsIfConstrained, probeModuleTags, validateModulesAccess — proxy-aware branches
platform/platform.go	discoverConstrainedPlatformVersions, releaseTagExists — proxy-aware branch for --include-platform discovery
pull.go	Passes ProxyRegistry option through PullServiceOptions → platform.Options / modules.Options
cmd/pull/flags/flags.go	--proxy-registry flag declaration
cmd/pull/pull.go	Mutual exclusivity with --deckhouse-tag / --since-version; passes flag to service options
cmd/pull/validation.go	validateProxyRegistryFlag
PROXY-REGISTRY.md	Full reference: pipeline diagram, walk algorithm, step-by-step worked example with HEAD request trace, HTTP semantics table, per-component behaviour table, performance notes, known caveats
README.MD	Short summary of proxy mode with link to PROXY-REGISTRY.md