feat: datumctl compute build

[savme]

Adds datumctl compute build, which builds a standard Dockerfile into an OCI image that runs on Datum Compute.

• Debug-by-default: running datumctl compute build . with no flags does a local build and reports success/failure without publishing anything, so it's safe to run as a pre-flight check.
• Familiar workflow: supports Dockerfile overrides (Dockerfile.datum is picked up by default), --target for multi-stage builds, --build-arg - similar conventions as docker build.
• Compat checks for Compute's runtime: checks for (and can auto-fix, see --fix) missing shared libraries, missing modules needed for hostname resolution, wrong CPU architecture, non-executable entrypoints, and shell-form CMDs that need a shell not present in the final image - tracing through startup scripts and wrapper entrypoints to check the real payload, not just the first thing exec'd. Also transparently wraps the startup command to honor WORKDIR, since the runtime doesn't apply it on its own.
• --analyze/--fix: surfaces the above as actionable findings; --fix applies the safe, exact-line Dockerfile edits it can (e.g. adding a missing COPY for a runtime library) and rebuilds, repeating since some issues only surface after an earlier fix is rebuilt in.
• Packaged as erofs: the final image ships as an erofs rootfs layer with no embedded kernel - Compute injects the correct runtime kernel at boot, so the image only needs to carry the application filesystem.
• --output: push to a registry, write a .tar OCI archive, or write a local OCI layout directory; registry pushes ask for confirmation unless --push is passed (for CI).
• Fully custom build escape hatch: if a Kraftfile is present (or passed via --kraftfile), the build is delegated entirely to the Unikraft's CLI instead of reimplementing its build semantics.
• datumctl compute build inspect: inspects an already-built image.

Closes #174

[savme]

Lint errors are due to a containerd dep requiring newer k8s.io versions. This is fixed on main (in bb566b0)