remove oras

[bcumming]

Remove uenv's runtime dependency on the external oras binary and replaces it with a self-contained, native OCI registry client written in C++ (src/oci/). After this change uenv is a fully static binary with no runtime shell-outs to oras, tar, gzip, or curl — all registry, archive, and hashing operations happen in-process. Images pushed by the new client are byte-for-byte compatible with oras, so artifacts remain interoperable in both directions.

oras was an external process uenv shelled out to for push/pull/copy/inspect. That made deployments depend on a separate binary, complicated error handling, and left the tool unable to be fully static. This PR brings all of that functionality in-house.

New features:

src/oci/ — native OCI registry client. A deliberately self-contained module (depends only on src/util/ + external libs; enforced by a grep in CI/docs) that talks the OCI distribution API over HTTP:

• client (pimpl'd), pull, push, copy, manifest handling, and referrers-API support (with fallback for registries that lack it)
• auth — bearer-token flow with re-authentication of expired tokens, and a docker-credential helper instead of silently falling back to anonymous access
• Strongly-typed domain vocabulary (digest, reference, tag, manifest) with its own lexer-based parse.*, so near-synonymous registry terms can't be mixed up
• Extensively documented in src/oci/readme.md

New src/util/ building blocks, kept in util so oci never reaches up into uenv:

• sha.* — in-process SHA-256 (blobs are hashed while streaming)
• url.* — a first-class URL type with consistent end-to-end handling
• archive.* — in-process tar pack/unpack via libarchive (replaces tar/gzip), oras-compatible
• Extended curl.* (streaming, upload progress), shared parse.* scaffolding, and lexer/string additions

Dependencies now vendored as static meson subprojects: zlib, openssl (curl's TLS backend), libarchive. Dropped the wrapdb fallback and the old curl runtime deps.

Bug fixes:

• Verify the digest of downloaded meta archives; stop buffering them in memory
• Downloads go to a temp file so a failed download leaves no half-written state
• Wrong-typed JSON in registry responses no longer aborts via an uncaught type_error
• Image copy no longer silently drops attached metadata
• Treat missing credentials on delete as a hard error
• Fixed a race in download-progress reporting

Tests:

• New unit suites: oci_auth, oci_client, oci_digest, oci_manifest, oci_parse, oci_registry, oci_tag, plus sha, url, archive, curl, subprocess
• New registry BATS suite exercising push/pull end-to-end against a throwaway local zot registry, with registry_ctl / listing_mock helpers (self-skips when no zot binary is present)