fix(tests): pull MinIO from a registry that still serves it

MinIO withdrew its public images. `minio/minio` on Docker Hub was deleted on
2026-09-11 -- the whole repository, not just `latest`, so pinning a tag does
not help -- and `quay.io/minio/minio` began requiring authentication on
2026-09-24. Free community builds stopped in October 2025 and the open-source
repository was archived in February 2026, so this is a withdrawal rather than
an outage: re-running a job will not clear it.

Every object-storage suite fails at collection in CI as a result -- test_gc,
test_npy_codec, test_codecs, test_attach, test_object -- while passing locally
for anyone with the old image still in their Docker cache, which is why this
did not show up until CI ran on a clean machine.

Switches the fixture to Chainguard's build, which is public, needs no
credentials, and is drop-in for testcontainers' MinioContainer. It is also the
safer choice on its own merits: the last community image is a year stale and
carries unpatched high-severity CVEs, while the Chainguard build is rebuilt
continuously.

The image is now read from DJ_TEST_MINIO_IMAGE, matching DJ_TEST_MYSQL_IMAGE,
so a deployment can point at its own mirror without editing tests.

Verified with the local MinIO cache deleted, so the pull is cold as it is in
CI: 118 passed across the five object-storage suites.

Author: dimitri-yatsenko

tests/conftest.py

@@ -174,8 +174,13 @@ def minio_container():
 
     from testcontainers.minio import MinioContainer
 
+    # MinIO withdrew its public images: `minio/minio` on Docker Hub is gone
+    # entirely (any tag, not just `latest`) and `quay.io/minio/minio` now
+    # requires authentication. Chainguard publishes a maintained build that
+    # needs no credentials and is drop-in for this fixture. Overridable so a
+    # deployment can point at its own mirror without editing tests.
     container = MinioContainer(
-        image="minio/minio:latest",
+        image=os.environ.get("DJ_TEST_MINIO_IMAGE", "cgr.dev/chainguard/minio:latest"),
         access_key="datajoint",
         secret_key="datajoint",
     )