Use the registry Last-Modified header as the only cooldown date source

The image config blob's `created` field records the image build time, which
is set by the build process and can differ arbitrarily from when the image
was actually pushed to the registry. Using it as a fallback meant Docker
cooldown windows were sometimes measured against build time rather than
publication time.

Drop the fallback so cooldown relies solely on the registry-reported
Last-Modified header. When that header is absent we fail open, as before.