Docker Hub pull limits: move base images to a team cache

When builders hit Docker Hub rate limits: pull base images through a team PROXY so runners stop each burning anonymous quota. Cold misses still count against Hub; business-image push is in the free cloud Docker registry article.