feat(container-registry): expose Container Registry repositories and tags

[polaz]

👍 React to this issue if you need this feature — helps us prioritise.

Problem

GitLab Container Registry is a daily-use DevOps surface (list repos, list tags, delete stale tags). We don't expose any of it as MCP tools — agents can't help with image cleanup, audit, or tag listings.

Two competing MCP servers (jmrplens, yoda-digital) already expose this.

Investigation done (current state)

Verified against src/entities/:

• ❌ grep -ri 'container.*registry\|registry.*repositor' src/ returns 0 hits
• ✅ TokenScopeDetector.ts recognises read_registry and write_registry scopes — we can hint at availability
• ✅ entities/shared.ts has container_registry_enabled field on project schema — we know it's enabled but expose no actions

Re-verify before coding:

grep -rIni 'container.*registry\|/registry/' src/
ls src/entities/ | grep -i registry

Acceptance criteria

• New entity src/entities/container_registry/ with:
  • browse_registry actions:
    • list_repositories (GET /projects/:id/registry/repositories)
    • get_repository
    • list_tags (GET /projects/:id/registry/repositories/:repo_id/tags)
    • get_tag (with manifest/digest details)
  • manage_registry actions:
    • delete_repository
    • delete_tag
    • delete_tags_in_bulk (name_regex, keep_n, older_than — useful cleanup primitives GitLab provides natively)
• Permission gating: writes require write_registry scope
• Integration tests creating a test image (use docker.io/library/hello-world mirror or skip if registry unreachable)

GitLab API

• Endpoints: /api/v4/projects/:id/registry/repositories + /registry/repositories/:id/tags
• Tier: Free (Container Registry itself is Free)
• Note: Container Registry must be enabled instance-wide
• Docs: https://docs.gitlab.com/api/container_registry/

Estimate

1d

Context

Found during GitLab 18→19 API landscape analysis. Competitors expose this; we have a real gap.