private registry docs should be clear about what images are required

[kwmonroe]

We've had a few pings from users that would like to use a private registry for some images and a public one for others. E.g. a user has a custom app they want to deploy in k8s that is only hosted in their registry, but they want all other images coming from rocks/dockerhub/gcr.io/etc.

At the moment, if a user specifies a private registry with the image-registry config option, we require all images be in that registry. We should make that clear in our docs.

Edit: See #237 for the somewhat related issue requesting better instructions for mirroring rocks images to a private registry. If users can batch-pull from rocks and batch-push to their own registry, I think that'll be a viable workaround until we support the private/upstream registry workflow.