Document pushing images to remote registries

[chruffins]

Layer 4 of remote registry push support (top of the stack: #348 ← #350 ← #353).

Adds user-facing docs for the outbound push feature:

• Features bullet: remote registry push with docker-style borrowed credentials
• Usage section with the docker-aligned credential model spelled out (credentials stay on the client, borrowed per push, never stored on the server; server's own logins as fallback)
• curl examples: creating a push with lent ECR credentials (the aws ecr get-login-password flow) and polling the job
• digest-preservation and ready-state notes

Docs-only; no code changes.

---

Note

Low Risk
Documentation-only changes with no runtime or security behavior changes in this PR.

Overview
README now documents exporting cached images to remote OCI registries via the authenticated API.

The Features list adds remote registry push with docker-style borrowed credentials. A new Pushing Images to Remote Registries section explains that client credentials are lent per push (not stored server-side), with fallback to the server’s ~/.docker/config.json, and includes curl examples for creating a push (including ECR password flow) and polling job status (queued → pushing → pushed | failed). It also notes digest preservation and that only ready images can be pushed.

^{Reviewed by Cursor Bugbot for commit 19d5bbe. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chruffins]

reviewed — accurate docs; all findings from the review are addressed in c411bbdd and 43740067 ($HYPEMAN_API_KEY in the curl examples, insecure and error-on-failure documented, ECR token hoisted, examples anchored to the real api.hostname/TLS-443 surface, and the api: config block documented).

status: all review findings addressed