ferro-oci-server: vendor opencontainers/distribution-spec conformance suite (v0.1.0 gate)

[youichi-uda]

Goal

Promote ferro-oci-server from v0.0.x (alpha) → v0.1.0 (beta)
once it passes the upstream
opencontainers/distribution-spec conformance test suite
end-to-end.

What we have today

• tests/conformance_smoke.rs — internal smoke harness that
  exercises every endpoint pair (start upload → chunked PATCH →
  finalize PUT → blob HEAD/GET → manifest PUT-by-tag → manifest
  GET-by-digest → referrers GET → tag list → catalog → delete).
• 67 tests pass (42 unit + 3 + 22 integration smoke).
• The error path for §6.2 OCI error codes is exercised but only
  on the variants we hit in the smoke walks.

What's missing

The official conformance harness is a Go-based runner that drives
a registry over real HTTP and asserts on a much larger surface
than our smoke tests. Vendoring it in is a multi-step task:

1. Decide vendor strategy: git submodule into vendor/oci-distribution-spec/,
   or pull tagged tarball into a CI-only path. (Submodule preferred —
   pinned to a release tag, easy to bump.)
2. Add a CI job that:
   • boots cargo run --example minimal_registry (which does not
     yet exist — also part of this issue, see [TODO]) on a known
     port,
   • runs the conformance harness against http://127.0.0.1:<port>,
   • parses the harness output and surfaces failures into the GH
     Actions log.
3. Triage the first run's failures into either crate-side fixes,
   harness configuration, or known-incompatibilities (with tracking
   issues per case).
4. Promote to v0.1.0 once the conformance run is fully green.

Out of scope for this issue

• Persistent metadata backend (SQLite / Postgres) — separate issue.
• Authentication trait — separate issue.
• Sigstore / SLSA / TUF / cosign integration — separate crates.

TODOs spawned by this

• Add examples/minimal_registry.rs so the conformance harness
  has something to run.
• Decide vendor strategy (submodule vs tarball).
• Add .github/workflows/oci-conformance.yml.
• First conformance run: triage results.
• Iterate on crate-side fixes per failure category.
• Cut v0.1.0 once the run is green.

References

• OCI Distribution Specification v1.1: https://github.com/opencontainers/distribution-spec
• Conformance suite source: https://github.com/opencontainers/distribution-spec/tree/main/conformance
• Reference Go server (for cross-checking expected behaviour):
  https://github.com/distribution/distribution