Fix OrbStack Docker Pull

Core Rule

Treat Docker Hub EOF on OrbStack as a network path problem until proven otherwise. Do not assume the image is missing, private, or platform-incompatible before testing a small public image and the daemon's proxy path.

Expected responses that are not failures:

• curl -I https://auth.docker.io returning HTTP/2 404 is normal for the auth service root.
• curl -I https://registry-1.docker.io returning HTTP/2 404 is normal for the registry root.
• curl -I https://registry-1.docker.io/v2/ returning 401 with www-authenticate: Bearer ... is the expected unauthenticated registry response.

Suspicious signals:

• docker pull hello-world:latest fails with Head "https://registry-1.docker.io/v2/.../manifests/latest": EOF.
• docker buildx imagetools inspect or docker manifest inspect fails while explicit curl -x http://127.0.0.1:<port> succeeds.
• registry-1.docker.io resolves to 198.18.0.x, which usually indicates Clash-style fake-ip/TUN routing.
• macOS has system HTTP/HTTPS proxy enabled, but OrbStack Docker daemon is still using an unstable automatic proxy path.