[CI] Two step epr image promotion (elastic#244517)

## Summary
Part of elastic#244476

Makes use of the configurability from
elastic/ci-agent-images#2045

This introduces a 2 step promotion, with the following outline:
- promote to `:temp` (step1) and start building the VM image with this
image
- when the VM image is updated with the cache, we promote image to
`:lite` which we're using in FTRs

Hopefully this will do away with any gaps between promotion and a
cache-warmed image.

Author: delanni

.buildkite/pipelines/fleet/package_registry.yml

@@ -1,5 +1,8 @@
 env:
   IGNORE_SHIP_CI_STATS_ERROR: 'true'
+  PACKAGE_REGISTRY_BASE_IMAGE: 'docker.elastic.co/package-registry/distribution:lite'
+  PACKAGE_REGISTRY_TEMP_IMAGE: 'docker.elastic.co/kibana-ci/package-registry-distribution:temp'
+  PACKAGE_REGISTRY_TARGET_IMAGE: 'docker.elastic.co/kibana-ci/package-registry-distribution:lite'
 steps:
   - command: .buildkite/scripts/lifecycle/pre_build.sh
     label: Pre-Build
@@ -130,8 +133,11 @@ steps:
         - exit_status: '-1'
           limit: 1
 
-  - command: .buildkite/scripts/steps/fleet/promote_package_registry.sh
-    label: Promote docker.elastic.co/package-registry/distribution:lite
+  - command: |
+      echo "--- Promoting base image to temp..."
+      docker buildx imagetools create -t "$PACKAGE_REGISTRY_TEMP_IMAGE" "$PACKAGE_REGISTRY_BASE_IMAGE"
+    label: 'Promote EPR image to temp'
+    key: promote-epr-to-temp
     agents:
       image: family/kibana-ubuntu-2404
       imageProject: elastic-images-prod
@@ -142,6 +148,42 @@ steps:
       - jest-integration
       - defend-workflows-stateful
       - defend-workflows-serverless
+    if: "build.branch == 'main'"
+    retry:
+      automatic:
+        - exit_status: '-1'
+          limit: 1
+
+  - label: 'Update cache for EPR image'
+    trigger: kibana-vm-images
+    key: epr-image-cache-update
+    build:
+      env:
+        EPR_IMAGE: "$PACKAGE_REGISTRY_TEMP_IMAGE"
+        IMAGES_CONFIG: 'kibana/image_cache.tpl.yml'
+        BASE_IMAGES_CONFIG: 'core/images.yml,kibana/base_image.yml,kibana/packages_layer.yml'
+        RETRY: '1'
+    depends_on:
+      - promote-epr-to-temp
+    if: "build.branch == 'main'"
+
+  - command: |
+      echo "--- Promoting temp image to final target..."
+      docker buildx imagetools create -t "$PACKAGE_REGISTRY_TARGET_IMAGE" "$PACKAGE_REGISTRY_TEMP_IMAGE"
+    label: 'Promote EPR image to final target'
+    key: promote-epr-image
+    agents:
+      image: family/kibana-ubuntu-2404
+      imageProject: elastic-images-prod
+      provider: gcp
+      machineType: n2-standard-2
+    depends_on:
+      - epr-image-cache-update
+    if: "build.branch == 'main'"
+    retry:
+      automatic:
+        - exit_status: '-1'
+          limit: 1
 
   - wait: ~
     continue_on_failure: true