Oci-image
OciImageBuilder refines BuilderSpec with image metadata (layers,
entrypoint, cmd, env, exposedPorts, labels, architecture, os) so OCI
images carry their runtime contract in the type.
The ociImage smart constructor compiles a single config record into
a typed spec whose operations assemble a spec-conformant OCI image
layout (oci-layout, index.json, blobs/sha256/*) entirely at
build time: per-layer rootfs assembly and deterministic tar, then
config/manifest/index rendering in digest-chain order, a blob
self-check, scratch cleanup, and an image.oci.tar archive of the
layout — each as a named step so every fold renders the assembly
legibly.