Extract OCI image config; use it for -r's default command

read_oci_image_config() (src/oci_image.cpp) reads the image config
blob referenced by the manifest and extracts User, ExposedPorts (as
OciExposedPort{port, OciPortProtocol}, parsed from keys like
"3000/tcp"), Env, Volumes, and the effective default command
(Entrypoint ++ Cmd). Refactored the oci-layout/index.json/manifest
loading read_oci_layers() already did into a shared read_oci_manifest()
helper, since this is the first time a second "loud" (spdlog::error
on failure) caller needs the identical validation.

-r/--run now uses the image's own default command when none is given
on the command line, falling back to /bin/sh only if the image sets
neither Entrypoint nor Cmd. User/ExposedPorts/Env/Volumes are captured
but not applied anywhere yet -- that lines up with volumes/networking
still being deferred.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CLAUDE.md

@@ -23,6 +23,11 @@ Source layout (all under `src/`):
   derives an image name/tag from its `index.json` manifest annotations
   (`io.containerd.image.name` preferred, else `org.opencontainers.image.ref.name`),
   falling back to the archive's filename and `"latest"` respectively.
+  `read_oci_image_config()` reads the image config blob referenced by the manifest
+  and extracts `User`, `ExposedPorts`, `Env`, `Volumes`, and the effective default
+  command (`Entrypoint ++ Cmd`); `-r/--run` uses its command when none is given on
+  the command line. Only the default command is actually consumed today — the rest
+  is captured for when volumes/networking are implemented.
 - `containers_storage.{h,cpp}` — wraps the `containers-storage` CLI (`import-layer`,
   `mount`, `unmount`, `layer --json`, `delete-layer`), forcing `fuse-overlayfs` as the
   overlay `mount_program`. `cleanup_layer_chain()` walks a layer's parent chain