k8s: add registry-cred VSS + imagePullSecrets after prereq check

Prereqs verified on the cluster: VSO 1.3.0 (transformation supported,
openbao-kubernetes VaultAuth healthy), MQTT egress to 10.5.30.3:1883 reachable
from a pod, target nodes untainted, registry requires auth. Add
registry-cred-vaultstaticsecret.yaml (secret/registry/nexus -> dockerconfigjson,
mirroring existing cluster pattern) and wire imagePullSecrets into the DaemonSet.
README updated with verified prereqs + apply order.

k8s/daemonset.yaml

@@ -35,9 +35,8 @@ spec:
       # Only nodes explicitly opted in (see README: kubectl label node ...).
       nodeSelector:
         jbod-monitor: "enabled"
-      # If the registry needs auth, sync a regcred and uncomment:
-      # imagePullSecrets:
-      #   - name: regcred
+      imagePullSecrets:
+        - name: docker-registry-cred   # synced by registry-cred-vaultstaticsecret.yaml
       containers:
         - name: redis
           image: redis:7-alpine