Add OCI skill packager using ocispec types

[JAORMX]

Summary

• Implement the SkillPackager interface from interfaces.go
• Uses canonical ocispec types from github.com/opencontainers/image-spec/specs-go/v1 — no custom OCI struct definitions
• Reads skill directories, parses SKILL.md YAML frontmatter for metadata
• Creates per-platform OCI configs (ocispec.Image) with skill metadata in labels
• Creates manifests (ocispec.Manifest) with skill annotations and artifactType
• Creates multi-platform image indexes (ocispec.Index)
• Uses digest.FromBytes for diff ID computation, specs.Versioned for schema version
• Builds on the deterministic tar/gzip from Add deterministic tar and gzip utilities for OCI skills #22

Security:

• Rejects symlinks (both files and directories via d.Type() check)
• Rejects hardlinks and device entries
• Path traversal protection in filesystem reads
• Frontmatter size capped at 64KB to mitigate YAML parsing attacks
• Nil store panics at construction time

New dependencies: github.com/opencontainers/image-spec, gopkg.in/yaml.v3 (promoted from indirect)

Resolves #16

Test plan

• task passes (lint + test)
• task license-check passes
• Reproducibility: same input produces identical digests across separate stores
• Multi-platform: per-platform configs match index descriptor os/arch
• Security: symlink files, symlink directories, missing SKILL.md, missing name, invalid frontmatter, nonexistent dir all rejected
• OCI config: validates architecture, OS, rootfs, diff IDs, labels, history
• Index: validates schema version, media type, artifact type, annotations

🤖 Generated with Claude Code