Add package content (OCI blob) transfer via Iroh

[kitplummer]

Summary

peat-sidecar currently syncs package metadata (name, version, pull status, byte counts) but does not transfer actual package content (OCI layers/blobs) between peers. Each agent must independently pull from an OCI registry, which fails in DDIL-disconnected environments where the registry is unreachable.

Current State

The agent watcher polls ListPulledPackages and writes metadata to the packages/{agent-id}:{ref} collection (src/watcher.rs:219-270), tracking fields like total_bytes, pull_status, and reference. However, these are informational only — the actual OCI image layers are never transferred peer-to-peer.

The infrastructure for blob transfer already exists but is unused:

• NetworkedIrohBlobStore is initialized in src/node.rs:92-98 with Iroh's content-addressed blob capabilities
• Iroh natively supports chunked, resumable, content-addressed blob transfer over QUIC
• The blob_store field is stored on SidecarNode (src/node.rs:35) but only used for endpoint management

Proposed Approach

1. Blob ingestion: Add an RPC (e.g., ImportBlob) or watcher extension that reads OCI layers from the local agent's registry and imports them into the Iroh blob store
2. Content-addressed transfer: Use Iroh's built-in blob sync to replicate content-addressed blobs to peers — this handles chunking, deduplication, and resumable transfer automatically
3. Blob retrieval: Add an RPC (e.g., ExportBlob) that exports a blob to the local filesystem or pipes it into the agent's registry
4. Manifest tracking: Extend the packages collection metadata with Iroh blob hashes so peers know what content is available in the mesh
5. Bandwidth awareness: Consider configurable rate limits for blob transfer to avoid saturating constrained DDIL links

API Changes

New proto RPCs to consider:

rpc ImportBlob(ImportBlobRequest) returns (ImportBlobResponse);
rpc ExportBlob(ExportBlobRequest) returns (ExportBlobResponse);
rpc GetBlobStatus(GetBlobStatusRequest) returns (GetBlobStatusResponse);
rpc ListBlobs(ListBlobsRequest) returns (ListBlobsResponse);

Impact

This is the highest-value gap for DDIL fleet operations — without it, edge clusters that lose registry connectivity cannot receive new packages from peers that already have them cached.

References

• src/node.rs:92-98 — existing NetworkedIrohBlobStore initialization
• src/watcher.rs:219-270 — current metadata-only package sync
• Iroh blob documentation for content-addressed transfer
• peat#747 (umbrella), peat#751 (fleet state)