The one place the freshdock outbound HTTP client is configured, so the OCI
registry digest flow and the Phase 6 HTTP notification backends share one
TLS stack, timeout, and user-agent instead of each building their own (DRY).
The single “is there a newer image?” path, shared by freshdock check and
the scheduler daemon (DRY). Resolves the local manifest digest, routes to
the registry, and returns a ProbeOutcome each caller renders or acts on.