Support OCI registries for chunk storage

[folbricht]

Adds support for using OCI container registries (ghcr.io, Docker Hub, Harbor, zot, distribution, ...) as chunk stores, addressing #253. Registries are widely available, often free or low cost, and typically CDN-backed, making them an attractive way to distribute chunks publicly without running any server infrastructure.

A registry store is used like any other store with the new oci+https (or oci+http) scheme and supports reading, writing, pruning, and use as a cache:

desync make -s oci+https://ghcr.io/myuser/mystore file.iso.caibx file.iso
desync extract -s oci+https://ghcr.io/myuser/mystore -c /var/tmp/cache file.iso.caibx file.iso

Design

Every chunk is stored as its own OCI artifact: a blob holding the chunk data (zstd-compressed unless the store is configured with uncompressed), referenced by a minimal image manifest with artifact type application/vnd.desync.chunk.v1 that is tagged with the chunk ID in hex.

The chunk ID appearing only in the tag — never as a blob digest — is the key design point, and differs from the earlier draft of this PR which stored bare blobs whose digest was the chunk ID. The rework has these consequences:

• Default digest algorithm works. OCI blob digests must be SHA256, which previously forced --digest=sha256 and made OCI stores incompatible with every store and index using desync's default SHA512/256. With the chunk ID in the tag, both algorithms work and OCI stores compose freely with other stores and caches.
• Compression works. Registries verify that uploaded content matches the declared digest, so bare blobs could only ever hold uncompressed data. With the digest decoupled from the chunk ID, chunks are stored compressed by default like in every other store type.
• Chunks are safe from garbage collection. Registries GC blobs that aren't referenced by a manifest, and some (ghcr.io) won't even serve unreferenced blobs — the earlier bare-blob approach didn't reliably work there at all. Tagged manifests keep every chunk referenced.

The cost is one extra round trip per read (manifest by tag, then blob; writes take three requests) and one tag per chunk in registry UIs, so a dedicated repository is recommended. Unrelated artifacts sharing the repository are safe, including from prune, which only touches tags that parse as chunk IDs.

prune deletes the manifests of unreferenced chunks; reclaiming blob space is left to the registry's own garbage collection. Manifest deletion must be supported and enabled on the registry (distribution: REGISTRY_STORAGE_DELETE_ENABLED=true; ghcr.io only deletes via the GitHub Packages API).

Authentication

Credentials are resolved in order: DESYNC_OCI_USERNAME/DESYNC_OCI_PASSWORD environment variables (convenient in CI), the new oci-credentials config section (keyed by host/repository, glob patterns supported), and finally the Docker credential store — registries logged into with docker login or oras login work with zero desync configuration. Anonymous access works for public repositories.

The standard store options (uncompressed, timeout, error-retry, error-retry-base-interval, trust-insecure, ca-cert, client-cert/client-key) are all wired up.

Trying it out locally

No credentials or external services needed — a throwaway registry container is enough:

# Start a local registry (with deletes enabled so prune works too)
podman run -d --rm --name registry -p 5000:5000 \
  -e REGISTRY_STORAGE_DELETE_ENABLED=true docker.io/library/registry:2

# Chunk a file and store the chunks in the registry
desync make -s oci+http://127.0.0.1:5000/test/store file.iso.caibx file.iso

# The chunks are visible as tagged artifacts in the registry
curl -s http://127.0.0.1:5000/v2/test/store/tags/list | jq .

# Reassemble the file from the registry
desync extract -s oci+http://127.0.0.1:5000/test/store file.iso.caibx restored.iso
cmp file.iso restored.iso

# Drop all chunks not referenced by the index
desync prune -s oci+http://127.0.0.1:5000/test/store file.iso.caibx

(docker works the same as podman here.)

Testing

• Unit tests run against a minimal in-process OCI registry covering roundtrips with the default SHA512/256 digest, compressed and uncompressed stores, missing chunks, corrupted chunk detection, remove, prune (including foreign artifacts surviving), plain-HTTP scheme handling, and credential resolution.
• Verified end-to-end against a real distribution registry (registry:2): make/extract/info/prune round trips with the default digest algorithm, byte-identical extraction, cache composition, and prune removing exactly the unreferenced chunks while other indexes keep extracting.

Not included: verify support (the command is currently local-store only, and verifying a registry store means downloading it in full) — possible follow-up if there's demand.

Closes #253