implement auth

Signed-off-by: Jason Hall <jason@chainguard.dev>

tests/testdata/auth_credential_helper.txt

@@ -0,0 +1,62 @@
+# Test credential helper execution
+
+# Create a mock credential helper that logs when it's called
+-- docker-credential-mock --
+#!/bin/sh
+# Mock credential helper that logs execution and returns test credentials
+
+# Log that we were called
+echo "MOCK_HELPER_CALLED" >&2
+
+case "$1" in
+  get)
+    # Read registry from stdin
+    read registry
+    echo "MOCK_HELPER_REGISTRY=$registry" >&2
+
+    # Return credentials
+    cat <<EOF
+{
+  "Username": "helper-user",
+  "Secret": "helper-pass"
+}
+EOF
+    ;;
+  *)
+    exit 1
+    ;;
+esac
+-- Cargo.toml --
+[package]
+name = "cred-helper-test"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+-- src/main.rs --
+fn main() {
+    println!("Testing credential helper");
+}
+
+# Make the helper executable
+chmod +x docker-credential-mock
+
+# Create Docker config that uses our mock helper
+mkdir .docker
+-- .docker/config.json --
+{
+  "credHelpers": {
+    "mock.registry.io": "mock"
+  }
+}
+
+# Add current dir to PATH and set HOME
+env HOME=$WORK
+env PATH=$WORK:$PATH
+env RUST_LOG=debug
+
+# Try to push to mock.registry.io (will fail at network level, but should call helper)
+# Using --no-push to avoid actual network call
+! exec ./krust build --platform linux/amd64 --image mock.registry.io/test:latest .
+# Should see the helper being attempted
+stderr 'credential helper'