Document image.source (build|registry) in docs/modules.md and README

[RonaldHensbergen]

Part of #407, depends on #532 (Dagster) and #534 (Superset).

Scope

1. Update docs/modules.md to document the image.source/image.tag config pattern: when to use build (local dev, iterating on a Dockerfile) vs registry (production, pulling the scanned/signed artifact published by publish-images.yml), with a YAML example matching Allow modules to pull published images instead of always building locally #407's proposal.
2. Cross-link to docs/image-scanning.md so readers understand the provenance/signing guarantee source: registry is actually buying them (cosign attestation, Trivy gate before push).
3. Document the new validator error/warning codes added in Validate image.source: registry requires a tag; discourage tag: latest #533 in README.md's error-code table, matching the style used for E103–E106 (Profile composition: support layered/extended profiles to reduce duplication #175).
4. Add a short example profile snippet (e.g. under profiles/ docs or an example environment overlay) showing a production-style profile using image.source: registry for both Dagster and Superset.

Relationship

Parent issue: #407. Depends on #532, #533, #534.