Convert container_manifest.go queries to the jet builder

internal/datastore/container_manifest.go is the one file in the datastore package whose queries are raw SQL end to end (seven statements, jet imported only for the qrm.DB handle type). Every other store builds queries with jet, and docs/dev/database-query-patterns.md says to use jet for all queries. The management manifests list now builds with jet and feeds the file's shared scanner, so the remaining raw statements are GetContainerManifestByDigest, DeleteByID, ChildManifestsExist, buildReferrersQuery, and the scan plumbing (containerManifestColumns, scanContainerManifest, scanContainerManifestRows, queryOneContainerManifest).

Two things make this conversion its own change rather than a review fix:

• The domain struct cannot embed the generated model: model.ContainerManifests types Annotations as *string and SubjectDigest as *[]byte, against the domain's json.RawMessage and []byte. A jet-scanned destination therefore needs either explicit alias tags on all 16 fields (each one a silent-zero-scan hazard per #410 (closed) if it drifts) or a change to the domain type's public surface, which has 29 reference sites across internal/format/oci and cmd/artifact-registry/wire_oci.go.
• The NULL-annotations round trip (nullableJSON on write, the scanner's local-buffer hop on read) is asserted by TestScanContainerManifest_AnnotationsRoundTrip_GeneratedShapes and friends, and jet's qrm zeroes NULL into json.RawMessage natively, so the conversion changes which mechanism those tests pin.

Roughly 250 LOC in the file plus test churn on the scanner-named tests and one benchmark.

Raised while reviewing chore(datastore): add container manifest reads ... (!1131 - merged) • Hayley Swimelar • 19.3, which converted the new list statement to the jet builder and deliberately left the rest.