CI migration: remove IDC dependencies from Jenkins jobs/pipelines

[ti-chi-bot]

Parent task to track migration of Jenkins jobs/pipelines away from IDC/internal dependencies (excluding pingcap/ticdc which is done).

Scope and concerns:

• Credentials/secrets: replace IDC-only tokens and internal accounts with cloud-appropriate secrets
• Artifact and cache endpoints: no internal HTTP/FTP/S3; use OCI or public storage
• Image build/push paths: all registries must be public/cloud accessible
• Kubernetes scheduling: remove IDC-specific labels/hostPath/affinity/tolerations
• Test environments: remove internal DNS/VPC-only service dependencies
• Language package mirrors: goproxy/npm/pip/maven/etc use official or public mirrors
• Cron/singleton jobs: avoid multi-Jenkins duplication, move to Prow periodic
• Observability/reporting: ensure log/report upload does not depend on internal services

Action plan:

1. Inventory and classify dependencies in Jenkins DSL and pipelines (non-ticdc)
2. Define replacement standards for artifacts, images, proxies, bazel cache, credentials
3. Update Jenkins job DSL (agent YAML, scheduling, labels)
4. Update pipelines (downloads/uploads, registries, cache, proxy config)
5. Migrate Jenkins cron/periodic jobs to Prow periodic
6. Validate via pilot repos and record build/test results
7. Roll out to remaining repos in batches