Add -i/--inspect to display an image's declared config

Prints user/group, exposed ports, env, volumes, and default command
from OciImageConfig without mounting or running the image. Extend
inspect_image_command() whenever OciImageConfig gains a new field.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Gv3s5jckJKzh6JkMoi2Akz

CLAUDE.md

@@ -17,7 +17,11 @@ status); this file stays the dense, file-by-file reference. Still early-stage.
 Source layout (all under `src/`):
 - `main.cpp` — CLI entry point, dependency checks, orchestration (`mount_image()`,
   `run_container()`, `cleanup_image()`, `unmount_image()`, `list_images_command()`,
-  `create_volume_command()`, `list_volumes_command()`, `delete_volume_command()`).
+  `inspect_image_command()`, `create_volume_command()`, `list_volumes_command()`,
+  `delete_volume_command()`). `inspect_image_command()` implements `-i/--inspect
+  <image.tar>`: prints every `OciImageConfig` field (user/group, exposed ports, env,
+  volumes, default command) without mounting or running the image — extend it
+  whenever `OciImageConfig` gains a new field (see `oci_image.{h,cpp}` below).
   `run_container()` unconditionally calls `read_oci_image_config()` and reuses the
   result for two independent defaults: the command to run (`Entrypoint ++ Cmd`) when
   none is given on the command line, and, when `--user` wasn't given, the sandboxed
@@ -41,8 +45,9 @@ Source layout (all under `src/`):
   and extracts `User` (split on `:` into `OciImageConfig::user`/`group`),
   `ExposedPorts`, `Env`, `Volumes`, and the effective default command
   (`Entrypoint ++ Cmd`). `user`/`group` and the default command are consumed by
-  `-r/--run` (see `main.cpp` above) — `ExposedPorts`/`Env`/`Volumes` are still just
-  captured for when networking/volumes are implemented.
+  `-r/--run`, and every field is displayed by `-i/--inspect` (see `main.cpp` above)
+  — `ExposedPorts`/`Env`/`Volumes` are otherwise still just captured for when
+  networking/volumes are implemented.
 - `containers_storage.{h,cpp}` — wraps the `containers-storage` CLI (`import-layer`,
   `mount`, `unmount`, `layer --json`, `delete-layer`), forcing `fuse-overlayfs` as the
   overlay `mount_program`. `cleanup_layer_chain()` walks a layer's parent chain
@@ -158,9 +163,9 @@ Build directory is `buildDir/` (already configured).
   (see `priv_drop_helper.cpp` in "Project state")
 - Run the executable: `./buildDir/slocker-lite -m <image.tar>` (see `--help` for the
   full flag list: `-m/--mount`, `-r/--run`, `-u/--umount`, `-c/--cleanup`,
-  `-l/--list-images`, `-n/--no-nsenter`, `--user`, `--group`, `-v/--volume`,
-  `--list-volumes`, `--delete-volume`, `--delete-volume-full`, `-t/--test`,
-  `--log-level`, `-h/--help`, `-V/--version`)
+  `-l/--list-images`, `-i/--inspect`, `-n/--no-nsenter`, `--user`, `--group`,
+  `-v/--volume`, `--list-volumes`, `--delete-volume`, `--delete-volume-full`,
+  `-t/--test`, `--log-level`, `-h/--help`, `-V/--version`)
 - Run tests: `meson test -C buildDir`
 
 ## Code style