Initial commit: OCI image mounting via containers-storage

slocker-lite validates an OCI Image Layout tar, imports its layers into
containers-storage's layer store in order, and mounts the assembled image
using fuse-overlayfs, printing the resulting merged path.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/oci_image.h

@@ -0,0 +1,44 @@
+// Copyright (C) 2026 Viorel Munteanu
+//
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; either version 2 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+#pragma once
+
+#include <filesystem>
+#include <optional>
+#include <string>
+#include <string_view>
+#include <vector>
+
+struct OciLayer {
+    std::string digest;      // "sha256:<hex>", as it appears in the manifest
+    std::string media_type;
+};
+
+// Validates that `tar_path` is an OCI Image Layout tar (oci-layout + index.json +
+// a referenced blobs/sha256/<digest> image manifest) and returns its layers in
+// base-to-top order. Logs a specific error via fmt and returns nullopt if anything
+// required is missing or malformed.
+std::optional<std::vector<OciLayer>> read_oci_layers(const std::filesystem::path& tar_path);
+
+// Extracts the raw bytes of blobs/sha256/<digest_hex> from `tar_path` into `out_file`.
+// Returns false (and logs) if the entry isn't found.
+bool extract_blob_to_file(const std::filesystem::path& tar_path,
+                           std::string_view digest_hex,
+                           const std::filesystem::path& out_file);
+
+// Strips the "sha256:" algorithm prefix from a digest string, e.g.
+// "sha256:abcd" -> "abcd". Returns the input unchanged if there is no such prefix.
+std::string oci_digest_hex(std::string_view digest);