fix(ci): investigate denied MinIO image pulls in S3 jobs #11250

Failure

Both AWS S3 provider jobs fail in Pre-pull S3 test images before any tests execute. The GitHub-hosted runners successfully pull Ryuk, then Docker denies access to the configured MinIO image on every retry.

• Run: https://github.com/dotnet/orleans/actions/runs/34648973278
• Head: 7a1c2dca7eaf0cc7223a90b3a9171010a7023bc2 (feat(streaming)!: unify stream partition recovery #10588)
• net8.0 job: https://github.com/dotnet/orleans/actions/runs/34648973278/job/103426425816
• net10.0 job: https://github.com/dotnet/orleans/actions/runs/34648973278/job/103426425778
• Image: minio/minio:RELEASE.2025-09-07T16-13-09Z

Error response from daemon: pull access denied for minio/minio, repository does not exist or may require 'docker login': denied: requested access to the resource is denied

The retry helper exhausted four attempts, with delays of 10, 30, and 60 seconds, in each job on September 11, 2026 at approximately 21:21–21:23 UTC.

Context

The pre-pull step and retry helper are unchanged from main in #10588. The run includes merged #11231, which addressed the transient HTTP 502 failure tracked in #11217. This failure instead consistently reports access denied despite those retries. Searches found no existing issue or PR covering this specific failure.

Expected outcome

Restore reliable access to the MinIO test image for anonymous CI pulls, or identify a supported replacement source and keep the pre-pull configuration aligned with the S3 test fixtures. Preserve the S3 test requirement. Registry availability, image publication, and runner-specific causes still need investigation; no local Docker reproduction has been attempted.