fix(ci): pull the MinIO image from Quay now that Docker Hub no longer serves it

Pull the MinIO server and client images from Quay instead of Docker Hub,
which no longer serves them. This affects the CI image pre-pull, the
testcontainers default for `MinIOContainer`, and the local
`docker-compose.yml` services. Both images stay pinned to the release
and multiplatform digest that were already in use, so nothing about the
images themselves changes.

Mono-RevId: 90fecfc34d8b72beee6f7728ac88f78096604dc4

Author: ericallam

.github/workflows/e2e-webapp.yml

@@ -102,7 +102,7 @@ jobs:
               redis:7.2 \
               testcontainers/ryuk:0.14.0 \
               ghcr.io/s2-streamstore/s2:0.40.0@sha256:b26249e2ede0949755f5af8028185dc2bcfc3aa2db21eb9610543d144eb6ee9d \
-              minio/minio:latest
+              quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z@sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e
             do
               pull "$image" &
               pids+=("$!")

.github/workflows/unit-tests-webapp.yml

@@ -109,7 +109,7 @@ jobs:
               redis:7.2 \
               testcontainers/ryuk:0.14.0 \
               electricsql/electric:1.2.4@sha256:20da3d0b0e74926c5623392db67fd56698b9e374c4aeb6cb5cadeb8fea171c36 \
-              minio/minio:latest
+              quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z@sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e
             do
               pull "$image" &
               pids+=("$!")

docker/docker-compose.yml

@@ -144,7 +144,7 @@ services:
   # routes to it when the OBJECT_STORE_* env vars are set (see .env.example).
   minio:
     container_name: ${CONTAINER_PREFIX:-}minio
-    image: minio/minio:latest@sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e
+    image: quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z@sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e
     restart: always
     command: server /data --console-address ":9001"
     environment:
@@ -165,7 +165,7 @@ services:
       start_period: 5s
 
   minio-init:
-    image: minio/mc:latest@sha256:a7fe349ef4bd8521fb8497f55c6042871b2ae640607cf99d9bede5e9bdf11727
+    image: quay.io/minio/mc:RELEASE.2025-08-13T08-35-41Z@sha256:a7fe349ef4bd8521fb8497f55c6042871b2ae640607cf99d9bede5e9bdf11727
     depends_on:
       minio:
         condition: service_healthy

internal-packages/testcontainers/src/minio.ts

@@ -16,7 +16,9 @@ export class MinIOContainer extends GenericContainer {
   private secretAccessKey = "minioadmin";
   private region = "us-east-1";
 
-  constructor(image = "minio/minio:latest") {
+  constructor(
+    image = "quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z@sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e"
+  ) {
     super(image);
     this.withExposedPorts(MINIO_PORT);
     this.withCommand(["server", "/data"]);