Split OciImageConfig's user into separate user/group fields

--user/--group are now handled as separate strings (ResolvedUser), so
parse config.User's "<user>[:<group>]" the same way instead of leaving
callers to split the combined spec themselves.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Gv3s5jckJKzh6JkMoi2Akz

src/oci_image.cpp

@@ -368,7 +368,14 @@ std::optional<OciImageConfig> read_oci_image_config(const std::filesystem::path&
     try {
         json runtime_config = config_json.value("config", json::object());
 
-        result.user = runtime_config.value("User", "");
+        std::string user_spec = runtime_config.value("User", "");
+        auto colon_pos = user_spec.find(':');
+        if (colon_pos == std::string::npos) {
+            result.user = user_spec;
+        } else {
+            result.user = user_spec.substr(0, colon_pos);
+            result.group = user_spec.substr(colon_pos + 1);
+        }
 
         json exposed_ports = runtime_config.value("ExposedPorts", json::object());
         if (exposed_ports.is_object()) {

src/oci_image.h

@@ -66,7 +66,8 @@ struct OciExposedPort {
 };
 
 struct OciImageConfig {
-    std::string user;                          // config.User, e.g. "git:git"; empty if unset
+    std::string user;                          // config.User's "<user>" part; empty if unset
+    std::string group;                         // config.User's optional ":<group>" part; empty if unset
     std::vector<OciExposedPort> exposed_ports;  // config.ExposedPorts keys, parsed "<port>/<proto>"
     std::vector<std::string> env;               // config.Env, e.g. "PATH=..."
     std::vector<std::string> volumes;           // config.Volumes keys, e.g. "/var/lib/mysql"