fix(layout): read OCI layouts whose blobs are symlinks; bump go-conta…

…inerregistry to v0.21.7 (#9)

* fix(layout): read OCI layouts directly so blobs may be symlinks

go-containerregistry v0.21+ refuses to open a layout blob that is a
symlink (pkg/v1/layout/blob.go openBlob), and Bazel's rules_oci
assembles oci_load layouts whose blobs are symlinks into the action
cache, so both drivers' --image-from-oci-layout paths die at blob-read
time on Bazel-built images. Replace layout.ImageIndexFromPath with an
in-package layout reader that resolves blobs with os.Open (which
follows symlinks) via go-containerregistry's partial package: the
layout stays readable in place, with no staging, copying, or temp
directories.

Co-Authored-By: Claude <noreply@anthropic.com>

* deps: bump github.com/google/go-containerregistry v0.20.7 -> v0.21.7

Removes EOL docker/docker v28.5.2 from dependency graph entirely. go-cr v0.21.7
migrated to moby/moby/api + moby/moby/client, clearing six Dependabot moby alerts.

Changes:
- Upgrade go-containerregistry to v0.21.7
- Remove docker/docker and docker/distribution indirect dependencies
- Update bazel deps for both bzlmod (MODULE.bazel) and WORKSPACE systems
- Remove gazelle_override for docker/docker since it's no longer a dependency
- Update go.mod and go.sum

All tests pass. Build succeeds. go mod graph confirms docker/docker absence.

---------

Co-authored-by: Claude <noreply@anthropic.com>

Revert "deps: bump github.com/google/go-containerregistry v0.20.7 -> …

…v0.21.7" (#7)

This reverts commit d19e74c.

build(release): migrate goreleaser config to v2, drop upstream ghcr k…

…o publish (#4)

The kos section pushed images to ghcr.io/googlecontainertools, which this
fork's GITHUB_TOKEN cannot write to; we only need the release binaries.
goreleaser-action resolves 'latest' (v2), which rejects v1-format configs,
so add version: 2 and switch archives.format to formats.

Co-authored-by: Claude <noreply@anthropic.com>