Validate image.source: registry requires a tag; warn on tag: latest

[RonaldHensbergen]

Resolves #533.

Summary

config.image.source: registry (e.g. modules/orchestration/dagster) needs
config.image.tag set to something pullable, but a plain JSON Schema
configSchema can't express "tag is required only when source is registry"
as a cross-field constraint. This adds validate_image_source_config() in
cli/validator.py to enforce it directly, wired into validate_loaded_profile
alongside the existing contract-binding/observability checks.

1. config.image.source: registry without config.image.tag (missing or
   empty string) → new error E103.
2. config.image.tag: "latest" under source: registry → new warning
   W097 (the profile still validates — this nudges toward pinned,
   reproducible versions per Allow modules to pull published images instead of always building locally #407's goal, matching the version scheme
   publish-images.yml already publishes).
3. config.image.source: build (the default) is unaffected — no new
   diagnostics for the existing local-build path.
4. Documented both codes in README.md's error-code reference table,
   matching the existing E1xx/W0xx entries' style.

Testing

• New ImageSourceConfigValidationTest in tests/test_validator.py:
  missing tag (error), empty-string tag (error), pinned tag (valid),
  tag: latest (warning, not error), source: build default path
  (unaffected), and a full validate_profile() run through a real
  module.yaml + profile.yaml fixture confirming tag: latest produces a
  warning with zero errors.
• Manually validated against the real
  modules/orchestration/dagster/module.yaml: no image config → clean,
  tag: latest → W097 only, pinned tag → clean, empty tag → E103.
• python -m unittest discover -s tests -p "test_*.py" -v — full suite,
  all pass.
• make lint — clean.