Manages caproni’s host-side pull-through zot registry. Owns the zot
binary lifecycle (start on caproni up, stop on the last
caproni destroy), config templating, and the flock-protected ref
counting that lets multiple profiles share a single zot instance.