Configure docker-credential-gcr to work with COS's read-only filesystem:
- Set HOME and DOCKER_CONFIG to writable /home/cloudservice location
- Run docker-credential-gcr configure-docker before pulling images
- Fix systemd ExecStartPre to use `-` prefix instead of `|| true` for optional commands
- Make region variable required (removed default)
- Fix trailing whitespace
Signed-off-by: Jason Hall <jason@chainguard.dev>