[sjmiller609]

Summary

Use the existing host-side registry mirror for non-Docker-Hub base images, so source builds can consume authenticated bases without registry passwords in build guests.

• Rewrite successfully mirrored FROM references to digest-pinned local-registry references, using the existing scoped build token.
• Preserve multi-platform indexes when rewriting tagged bases.
• Prepare a temporary source archive with the rewritten Dockerfile, preserving the stored source. This supports existing builder images that prefer the archive's Dockerfile over configuration.
• Correct digest-reference repository scopes during token creation/recovery; preserve fallback for unresolved build arguments.

The source registry still uses Docker's existing default keychain, including credential helpers. No new API/SDK fields or builder-image rebuild is required. Configure the host's source-registry authentication before switching consumers.

Validation

go test -short -p 4 ./lib/builds ./lib/images and vet pass. Repeated race tests pass for the new cases. An authenticated HTTP-registry test verifies index preservation, digest rewriting, the actual archive passed to volume import, unchanged stored input, and absence of source credentials from guest config. Disabling archive rewriting makes the regression test fail.

No live hypervisor/source-build deployment was performed.

[sjmiller609]

Closing because the private base-image migration is no longer required.