bcc90c7754
Give the mediamark image-build pipeline its own ServiceAccount so the docker step can push to the trusted in-cluster registry, mirroring arrproxy-ci.