fix: preserve registry bytes for unmodified image pulls

[alongubkin]

Pull-only image builds currently deserialize and rebuild the image configuration and OCI manifest. This changes content digests even when the image contents are unchanged, and repeated tag imports can make a running container's original image uninspectable in Docker's containerd store.

Preserve exact registry manifest, config and layer bytes when no image changes are requested. Resolve and cache the raw manifest by its immutable digest, validate that digest, and place tagging annotations on the OCI index descriptor. Derived-image builds retain the existing mutation path.

Validation: 38 library tests pass; the new local-registry test checks two fresh pulls and a cache hit against exact registry blobs. Two independent Alpine pulls produced the same manifest/config IDs; loading both into a Docker 29 daemon with the containerd snapshotter left the first container running and its original image inspectable.

Fixes ALIEN-1254. The local image loader consumer must adopt this commit after review.

Validation: 38 library tests passed. The registry integration test passed against a real local registry, verifying repeated pulls preserve manifest, config, and layer bytes. The consuming concurrent Docker test also passed with both containers running and their images inspectable after concurrent loads.

[greptile-apps]

Confidence Score: 4/5

[Medium risk] Adds a new code path for pulling and archiving container images.

The PR should not merge until valid raw-manifest cache hits can succeed without a cache write.

Findings

1.  Valid cache hits require writes ▶
2.  Warm cache path untested ▶

Fix with agent prompt

### Issue 1
src/image.rs:1481
A pull with a valid cached raw manifest still rewrites those same bytes, and any write error aborts the build. If the cache becomes full or read-only after the manifest was stored, the pull fails even though the required bytes are already available.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

### Issue 2
tests/pull_identity_tests.rs:65-69
Every iteration replaces the raw-manifest cache entry with `b"corrupt"` before pulling, so none tests a valid cache hit. The test can therefore pass even if repeated pulls unnecessarily fetch the raw manifest again.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

The PR preserves registry manifest, config, and layer bytes for pull-only images, repairs raw-manifest cache validation, and adds an identity test to CI.

• A warm cache hit now performs an unnecessary, failure-producing write.
• The updated test checks corrupt-entry replacement but no longer checks a valid cache hit.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Resolve base manifest] --> B{Raw manifest cache valid?}
  B -->|Yes| C[Reuse cached bytes]
  B -->|No| D[Fetch by digest and validate]
  C --> E[Write OCI archive]
  D --> E

Loading

_{Reviews (2) · Last reviewed commit: "fix: validate cached manifests and run i..."}