fix(backend): close the ReadCloser returned by PullBlob in push

pushIfNotExist pulled each blob's content from the source storage and then
handed it to Blobs().Push wrapped in io.NopCloser. The NopCloser is there
on purpose (Close on the distribution reader returns an error, see #50),
but it also means the original ReadCloser from PullBlob was never closed
on any path, leaking a file descriptor or HTTP body per blob.

Add a `defer content.Close()` immediately after the nil-error check so the
original reader is released on both success and error paths. The existing
NopCloser wrapper still prevents Push from calling Close itself, so the
workaround for #50 is preserved.

Fixes #491

Signed-off-by: SAY-5 <SAY-5@users.noreply.github.com>
Signed-off-by: Sai Asish Y <say.apm35@gmail.com>

Author: SAY-5

pkg/backend/push.go

@@ -186,6 +186,13 @@ func pushIfNotExist(ctx context.Context, pb *internalpb.ProgressBar, prompt stri
 		if err != nil {
 			return err
 		}
+		// The ReadCloser returned by PullBlob was previously never closed on
+		// either path, leaking the underlying file descriptor (or HTTP body)
+		// for every blob we pushed. Close on the distribution implementation
+		// returns an error (#50), which is why we still wrap the reader with
+		// io.NopCloser below, but we DO need to close `content` ourselves.
+		// See #491.
+		defer content.Close()
 
 		reader := pb.Add(prompt, desc.Digest.String(), desc.Size, tracker.WrapReader(content))
 		// resolve issue: https://github.com/modelpack/modctl/issues/50