fix(spur-net): apply OCI whiteouts safely

[joshkmartinez]

Closes #344.

Registry pulls only handled regular whiteouts, and Docker/Podman save imports did not handle whiteouts at all. That could leave files from lower layers in the flattened image.

The registry and daemon paths now use the same layer applier. it validates a layer before changing the rootfs, applies deletions before same-layer entries, handles opaque markers and file-type replacements, and rejects paths that escape the rootfs

Testing

• 25 focused layer tests covering regular and opaque markers, archive ordering, path containment, type changes, corrupt input, and tar metadata
• full spur-net suite: 79 tests
• Docker-save import tests: 6 tests using real manifest-ordered tar layers and filesystem extraction
• full spur-cli suite: 358 unit tests and 1 integration test
• affected-crate clippy with warnings denied, formatting, SPDX, and diff checks

was not able to fully test b/c I'm on macos, please confirm everything works as expected

[Copilot]

Pull request overview

Updates Spur’s OCI/Docker layer extraction to correctly and safely apply OCI whiteouts (including opaque markers) across both registry pulls (spur-net) and docker save imports (spur-cli), preventing lower-layer file leakage into flattened images.

Changes:

• Centralized OCI layer extraction into spur-net::image_layer::extract, adding validation, safe path handling, whiteout support (regular + opaque), and file-type reconciliation.
• Switched registry extraction (oci.rs) and docker-save import (spur-cli/src/image.rs) to use the shared layer applier with appropriate unpack policies.
• Added focused unit tests for whiteouts, ordering, path containment, and docker-save manifests; updated spur-cli deps for runtime tempfile usage.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
crates/spur-net/src/oci.rs	Replaces bespoke tar extraction with shared image_layer::extract for registry layers.
crates/spur-net/src/image_layer.rs	Introduces the shared layer extraction implementation, whiteout handling, safety checks, and extensive tests.
crates/spur-cli/src/image.rs	Updates docker save import to stage extraction and apply layers via image_layer::extract; adds tests.
crates/spur-cli/Cargo.toml	Promotes tempfile to a runtime dependency to support staging directory creation.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.