Add push SDK for uploading container images to OCI registry

[rgarcia]

Summary

Ports the push functionality from hypeman-go/lib/push.go to TypeScript, following the same patterns established by cp.ts.

Exported API

• pushImage(cfg, image, targetName) — Push any OciImageSource to the hypeman OCI registry. Core function analogous to Go's PushImage().
• push(cfg, sourceImage, targetName?) — Convenience: load from local Docker daemon and push. Analogous to Go's Push().
• pushFromURL(baseURL, apiKey, image, targetName) — Convenience with raw URL/apiKey instead of config object. Analogous to Go's PushFromURL().
• loadDockerImage(imageRef) — Load an image from the Docker daemon via docker save, returning an OciImageSource.
• OciImageSource interface — Abstraction for container images from any source (Docker daemon, custom builds, etc.).

Implementation details

• Uses OCI Distribution Spec for blob/manifest uploads (HEAD check, POST upload initiation, PUT blob, PUT manifest)
• JWT bearer auth matching the Go implementation
• Minimal tar parser for docker save output (no external tar dependency)
• Layers from Docker are gzipped before push (docker save outputs uncompressed layers)
• Re-exported from src/lib/index.ts barrel, importable as @onkernel/hypeman/lib/push

Differences from Go

• PushConfig uses baseURL (like CpConfig in TS) instead of registryHost — more consistent with the TS SDK pattern where users construct configs directly
• No ExtractPushConfig — the TS SDK doesn't use the request options extraction pattern
• OciImageSource interface replaces Go's v1.Image — lightweight interface, no dependency on go-containerregistry equivalent
• Uses child_process.spawn for docker save instead of Docker daemon API directly

Test plan

• Verify TypeScript compilation passes (tsc --noEmit)
• Test push() with a local Docker image against a hypeman registry
• Test pushImage() with a custom OciImageSource
• Test loadDockerImage() parses multi-layer images correctly
• Verify blob deduplication (existing blobs are skipped via HEAD check)

---

Note

Medium Risk
Adds new container image push functionality that performs authenticated HTTP uploads and parses docker save archives, which could impact users via network/protocol edge cases and large payload handling.

Overview
Adds a new lib/push module that can upload container images to Hypeman’s OCI registry, including helpers to derive PushConfig from a client, push an arbitrary OciImageSource, and load/push images from the local Docker daemon.

Implements the OCI Distribution upload flow (blob existence checks, blob uploads, and manifest publishing) and introduces accompanying Jest coverage for config extraction, reference parsing, and upload request behavior; also re-exports the new API from src/lib/index.ts and adds required dependencies (dockerode, tar-stream).

^{Written by Cursor Bugbot for commit 01ffee7. This will update automatically on new commits. Configure here.}