[deckhouse-cli] fix: dcql and pull

[ldmonster]

Summary

• Fix duplicate image pulls during d8 mirror pull for edition-scoped sources (FE/EE/SE, etc.): platform, modules, and security services now build download-list URLs from GetEditionRoot() instead of the bare registry root, so entries like .../deckhouse/release-channel:stable are no longer enqueued alongside the correct .../deckhouse/fe/release-channel:stable paths.
• Introduce registry.Service.GetEditionRoot() and keep GetRoot() for services that live outside the edition sub-tree (installer, plugins).
• Fix duplicate pushes during d8 mirror push: make ImageLayout.AddImage idempotent for the same (tag, digest) pair, and deduplicate OCI layout manifests by io.deckhouse.image.short_tag in the pusher (last descriptor wins).
• Fix visible flicker in d8 system queue watch by rendering each frame in an alt-screen buffer (cursor home + clear-to-end) instead of clearing the screen before every refresh.

Problem

When pulling from edition-scoped registries (e.g. --source=registry.deckhouse.ru/deckhouse/fe), the download list mixed bare-root and edition-scoped URLs for the same images/channels. That caused redundant network work and confusing logs.

Separately, repeated AddImage calls during platform pulls could append duplicate descriptors with the same short tag to the OCI layout, which then surfaced in push logs as the same tag being pushed multiple times (e.g. [1 / 337] ... cse:v1.73.2 and later [125 / 337] ... cse:v1.73.2).