feat(registry): wire OCI handlers, add conformance harness, finalize main (MR 5/5)

Why

Layer 4 (final) of the S12 OCI-local stack. The router that mounts OCI handlers behind auth middleware, the cmd/registry binary entry point, and the OCI Distribution Spec conformance harness.

With this MR merged, S12 is complete: an OCI Distribution Spec local repository served end-to-end with auth, content-addressable storage, and conformance coverage.

This MR is last because:

• internal/router imports oci, datastore, auth, middleware, observability (every layer below).
• cmd/registry imports the router and the gen/ config types from MR-0, plus everything in between.
• The conformance harness drives the full HTTP server, so it can only exercise OCI behavior once the binary boots end-to-end.

Issue: #19 (closed) Spec: S12 (already merged via !48 (merged))

Stack and merge order

#	MR	Branch	Targets	Blocks
0	!141 (merged)	19-oci-boilerplate	main	!124 (closed)
1	!124 (closed)	19-oci-foundation	19-oci-boilerplate	!125 (closed)
2	!125 (closed)	19-oci-database	19-oci-foundation	!126 (closed)
3	!126 (closed)	19-oci-cas	19-oci-database	!127 (closed)
4	!127 (closed)	19-oci-format	19-oci-cas	!128 (closed)
5	!128 (closed) ← you are here	19-oci-wiring	19-oci-format	n/a

What's in MR-5

12 files, ~1,800 insertions.

• internal/router/: HTTP route table. Mounts the auth middleware before the OCI handler tree, attaches request-scoped middlewares (request ID, body size, recovery), and wires the internal/observability recorder so auth-decision and HTTP-request metrics flow correctly.
• cmd/registry/: the service binary. main.go wires config (gen/artifactregistry/config/v1), the labkit observability stack, the database pool, the CAS driver, and the router. wire_fsdriver.go and wire_no_fsdriver.go use the fsdriver build tag to gate the local-development driver out of the default build.
• scripts/conformance/: OCI Distribution Spec conformance harness. run.sh boots a local AR + Postgres + token endpoint, applies the namespace fixtures via provision.sh, runs the upstream Ginkgo suite, and emits a JUnit report. tokensrv/main.go is a minimal token-issuing endpoint scoped to the conformance run.
• .gitlab-ci.yml: adds conformance:oci job. Runs on every MR. The harness boots a fresh AR + Postgres + token endpoint each pipeline run (~2 min). This is the merge gate for S12 so the cost is acceptable.

Test plan

• CI green on this MR including conformance:oci (the full upstream OCI Distribution Spec conformance suite passes).
• go build -tags=fsdriver ./cmd/registry compiles cleanly.
• go test -count=1 ./cmd/registry/... ./internal/router/... passes.
• Conformance harness runs locally (mise run conformance). Verified against the rebuilt stack.

Note on rebase

This MR was rebuilt fresh on top of MR-4. One signature drift surfaced during the rebuild: internal/router/router.go was updated to pass deps.Logger as the 4th argument to auth.Middleware (added in foundation review-feedback round 3). The original wiring branch was based on the pre-review foundation snapshot.