[crazy-max]

This PR restores anonymous Bearer token resolution from #6744 when no client session is active and preserves BuildKit's existing default-mode local fallback behavior.

The important clarification from the follow-up discussion is that BuildKit ResolveModeDefault is still remote-first. In v0.29, default mode only used the local image store opportunistically when remote Resolve() failed, and it returned the original remote error if local lookup also failed:

buildkit/util/resolver/pool.go

Lines 250 to 262 in 8543ce4

	n, desc, err := r.Resolver.Resolve(ctx, ref)
	if err == nil {
	atomic.AddInt64(&r.handler.counter, 1)
	return n, desc, nil
	}
	if r.mode == ResolveModeDefault && r.is != nil {
	if img, err := getImageByRef(ctx, r.is, ref); err == nil {
	return ref, img.Target, nil
	}
	}
	return "", ocispecs.Descriptor{}, err

The regression from anonymous auth is that remote Resolve() can now succeed without a session, then fail later during image config or platform selection. This PR applies the same opportunistic local fallback at that later failure point, without changing pull mode or making BuildKit default mode prefer local.

This is separate from Moby's Docker build semantics. Moby currently maps PullParent=false to BuildKit image-resolve-mode=default and PullParent=true to pull: https://github.com/moby/moby/blob/675945d39e1b4dc0e5806b216191e29094e43ec1/daemon/internal/builder-next/builder.go#L350-L354. If Moby wants stronger legacy builder "local parent wins" behavior, that should be handled explicitly in Moby by choosing the appropriate resolve mode, not by changing BuildKit default mode here.