Implement OCI image support
(Please review commit-by-commit to see the changes more clearly! This PR consists of removing all half-baked OCI go code from last iteration, and implementing the new support feature.)
Previous attempts focused on handrolling code around existing open source libraries instead of leveraging compiled open source tools directly, thus bloating the size dramatically.
In this latest attempt, crane and umoci are heavily relied upon as a tool directly, thus, containing the entire OCI support surface from the last attempt within very reviewable size.
Closes https://github.com/sysprog21/elfuse/issues/31
Summary by cubic
Replaces the Go elfuse-oci pull-only tool with a Python OCI front end that can actually run images under elfuse. scripts/elfuse-oci.py pulls images with crane, unpacks each image digest once with umoci onto a sealed read-only case-sensitive APFS volume, and runs it under elfuse with a per-run writable shadow so guest writes have somewhere to land. The Go binary, its build rules, and the Linux CI job are removed; an oci-smoke lane on the self-hosted macOS runner covers the script end to end, and scripts/test-elfuse-oci.py provides table tests that need no image.