simpler check and deps messages

rig/docs/notes/registry.md

@@ -0,0 +1,41 @@
+# ctrl/registry.sh
+
+## Registry modes
+
+Registry plumbing. This is the seam — not a tool. Four modes, selected by
+`REGISTRY_MODE` in the active profile:
+
+- **none** — Tilt builds straight into the node. No registry at all, and so no
+  guard against an outward push: an unqualified image name means
+  `docker.io/library/<name>`, and only Tilt's kind detection stands between that
+  and a real push. Throwaway use only; every profile here now defaults to `local`
+  instead.
+- **local** — a `registry:2` container wired into the cluster.
+- **mirror** — the same container, but configured as a pull-through cache of the
+  corporate registry. This is what a locked-down client actually looks like:
+  images originate from corp, you don't hammer it, and you keep working when the
+  VPN drops.
+- **remote** — no local container; pull straight from the corporate registry
+  using an imagePullSecret.
+
+## Why a script rather than ctlptl
+
+Deliberately a script rather than a tool. ctlptl collapses the `local` wiring
+into one line, but its Registry spec only accepts name/port/image/listenAddress —
+there is no way to set `REGISTRY_PROXY_REMOTEURL`, so it cannot express `mirror`
+at all. Keeping the seam here is what keeps the corporate registry swappable.
+
+## CA trust (install_ca_into_nodes)
+
+A corporate registry is almost always fronted by an internal CA, and trust has to
+reach three separate places. Nothing does this for you, and the symptom when it's
+missing is an opaque:
+
+    x509: certificate signed by unknown authority
+
+1. the host docker daemon — `/etc/docker/certs.d/<host>/ca.crt` (needs root)
+2. every kind node's containerd — nodes do NOT inherit host trust
+3. anything doing HTTPS from inside the cluster, in its own trust store
+
+`registry.sh` handles (2) because it's ours to handle. (1) is reported by
+`check.sh` since it needs root. (3) belongs to the workload.