k8s: add registry-cred VSS + imagePullSecrets after prereq check

Prereqs verified on the cluster: VSO 1.3.0 (transformation supported,
openbao-kubernetes VaultAuth healthy), MQTT egress to 10.5.30.3:1883 reachable
from a pod, target nodes untainted, registry requires auth. Add
registry-cred-vaultstaticsecret.yaml (secret/registry/nexus -> dockerconfigjson,
mirroring existing cluster pattern) and wire imagePullSecrets into the DaemonSet.
README updated with verified prereqs + apply order.

k8s/registry-cred-vaultstaticsecret.yaml

@@ -0,0 +1,18 @@
+# Image pull secret for docker.adamksmith.xyz, synced by VSO from OpenBao.
+# Mirrors the cluster's existing *-registry-cred pattern (secret/registry/nexus
+# -> dockerconfigjson). Referenced as imagePullSecrets in the DaemonSet.
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: docker-registry-cred
+  namespace: jbod-monitor
+spec:
+  vaultAuthRef: vault-secrets-operator-system/openbao-kubernetes
+  mount: secret
+  path: registry/nexus
+  type: kv-v2
+  refreshAfter: 1h
+  destination:
+    name: docker-registry-cred
+    create: true
+    type: kubernetes.io/dockerconfigjson