feat: consolidate OCI interoperability with current modular CLI

[ORESoftware]

Scope

Consolidates the previously certified OCI planner, local image-layout materializer, and authenticated ORAS push implementation directly onto current main.

This replaces the stale multi-PR product stack with one conflict-free branch while preserving all newer mise, Nix, fetch, Git-submodule, managed-install, transaction-locking, and CLI-model work.

Architecture

OCI is integrated through the repository's current modular command pattern:

• oci_command::dispatch routes the oci family before normal Zed registry configuration or transaction recovery;
• root help and Bash/Zsh completion are augmented without rewriting the central Cmd enum;
• the byte-level planner, local layout, and ORAS transport modules are the exact previously certified blobs;
• current main remains authoritative for all non-OCI files and behavior.

Commands

zed oci plan oci://ghcr.io/acme/tool:1.2.3 --json
zed oci plan oci://ghcr.io/acme/tool:1.2.3 --out dist/tool-layout
printf'%s\n'"$REGISTRY_TOKEN"| zed oci push \
dist/tool-layout \
oci://ghcr.io/acme/tool:1.2.3 \
--username "$REGISTRY_USER" \
--password-stdin

Security boundaries

• planning and layout materialization read no registry credentials and perform no network request;
• push requires one explicit authentication mode;
• password-stdin credentials use a temporary mode-0600 registry config and never enter ORAS arguments;
• every descriptor, byte count, SHA-256, media type, and exact blob-set membership is verified before transport;
• tag replacement fails closed without explicit consent;
• remote digest is resolved and verified after copy;
• OCI dispatch returns before normal Zed Config construction and transaction recovery.

Validation

This PR intentionally relies on the repository's normal read-only workflow matrix. A clean-room e2e PR will repin the existing planner, local-layout, and authenticated-registry contracts to the final exact commit on this branch.

Supersedes the stale product stack: #44, #56, and #93.

Linear: DEN-1420

[linear-code]

DEN-3736