feat(deploy): run RoboCo from pre-built registry images

The orchestrator spawned agents only by bare image names and built any
missing image from source on the host, so a deployment had to carry the
build context and a toolchain — there was no way to just pull and run the
images the release workflow publishes.

Add two settings (default empty = unchanged local-build behavior):
ROBOCO_AGENT_IMAGE_REGISTRY and ROBOCO_AGENT_IMAGE_TAG. When a registry is
set, the orchestrator spawns and ensures {registry}/roboco-agent-*[:tag] and
pulls (never builds) any image it lacks. Also adds the previously-missing
agent-secretary image to the lazy-build map.

Ship docker-compose.registry.yml: a standalone compose that pulls every
published image (GHCR or Docker Hub, pinnable version) and wires the
orchestrator to spawn the matching pre-built agent images. The existing
build compose files are unchanged.

roboco/config.py

@@ -393,6 +393,32 @@ class Settings(BaseSettings):
         ),
     )
 
+    # ==========================================================================
+    # Agent container images (spawn source)
+    # ==========================================================================
+    # By default the orchestrator builds each specialized agent image locally
+    # from docker/agent-*.Dockerfile the first time it spawns that role (the
+    # build/test flow). Set a registry to run the PRE-BUILT images the release
+    # workflow publishes instead — the orchestrator then pulls
+    # `{registry}/roboco-agent-*[:tag]` rather than building, so a deployment
+    # never needs the source tree or a build toolchain. Empty = local build
+    # (unchanged behavior).
+    agent_image_registry: str = Field(
+        default="",
+        description=(
+            "Registry namespace for pre-built agent images, e.g. "
+            "'ghcr.io/rennf93' or 'docker.io/renzof93'. Empty builds locally."
+        ),
+    )
+    agent_image_tag: str = Field(
+        default="",
+        description=(
+            "Tag for pre-built agent images (e.g. 'latest' or '0.5.0'). Empty "
+            "leaves the tag implicit (':latest'); only meaningful with "
+            "agent_image_registry set."
+        ),
+    )
+
     # ==========================================================================
     # Transcript retention (agent Claude Code transcripts under ~/.claude)
     # ==========================================================================