chore(infra): extract S12 OCI local boilerplate (MR 0/5)

Why

!124 (S12 OCI foundation, MR 1/5) is the entry point for the OCI-local stack but still carries 5,200+ lines mixed with file-level boilerplate that doesn't need code review. Pawel asked for the boilerplate to land first as a separate, fast-merge MR so the rest of the stack can focus reviewer attention on Go code.

This is MR 0 of a 6-MR stack. Every file in this MR comes from the existing 19-oci-{foundation,database,format,wiring} branches at HEAD. After this lands, we rebuild MRs 1-5 on top with code-only diffs.

Issue: #19 (closed) Spec: S12 (already merged via !48 (merged))

Stack and merge order

#	MR	Branch	Targets	Blocks
0	!141 (merged) ← you are here	19-oci-boilerplate	main	!124 (closed)
1	!124 (closed)	19-oci-foundation	19-oci-boilerplate	!125 (closed)
2	!125 (closed)	19-oci-database	foundation	!126 (closed)
3	!126 (closed)	19-oci-cas	database	!127 (closed)
4	!127 (closed)	19-oci-format	cas	!128 (closed)
5	!128 (closed)	19-oci-wiring	format	n/a

What's in MR-0

20 files, 2,352 insertions, 79 deletions. Every file comes verbatim from the named source branch's HEAD.

From foundation (19-oci-foundation)

• proto/artifactregistry/config/v1/{config,secret}.proto: ServerConfig, AuthChallengeConfig, DatabaseConfig, TLSConfig, and the new SecretRef one-of (env or file).
• gen/artifactregistry/config/v1/{config,secret}.pb.go: generated. buf generate is a no-op against the protos in this MR (verified locally).
• buf.yaml: breaking strictness flips FILE to WIRE. WIRE permits reserved-deletes via FIELD_NO_DELETE_UNLESS_NUMBER_RESERVED, which is the right strictness for config protos.
• .gitlab-ci.yml: validate-stage hardening. Adds test:bench-regression (benchstat MR-vs-target, hard-fail on B/op and allocs/op deltas, soft-report on sec/op), test:fuzz (-fuzztime=30s per Fuzz target), lint:migration-ordering, lint:migrations, jet:generate-check, and tightens buf:lint / generate-check / breaking. Both bench and fuzz are gated by changes: rules on internal/{auth,middleware,observability}/**/*.go so they don't run on this MR (which adds no Go packages).
• .gitignore: adds .tmp/, bin/, bench/.
• lychee.toml: adds one private-GitLab exclude.
• docs/dev/configuration.md: Donkey to Packhorse rename.
• docs/plans/TEMPLATE.md: clarification on test-file scoping.

From database (19-oci-database)

• .gitlab-ci-asdf-versions.yml, .gitlab-ci-other-versions.yml: dev-tooling version pins (consumed by main .gitlab-ci.yml).
• .markdownlint-cli2.yaml, .yamllint.yaml: lint configs.

From format (19-oci-format)

• docs/plans/2026-04-28-oci-local.md: the OCI-local plan file. Lives at the repo root rather than on !109's branch per the project memory's code-first ADR workflow agreement.
• docs/dev/oci-spec-gaps.md: S12 spec-gap journal. Appended to during implementation. The initial entries are already documented.
• docs/dev/README.md: index update to surface the spec-gaps doc.

From wiring (19-oci-wiring)

• docs/specs/README.md: one-line refresh.

What's deliberately excluded

• Caproni files (caproni/, caproni.yaml, plus the caproni-supporting .air.toml, .fairway/manifest.yaml, scripts/chart-gen.sh). All of these land via !59 (merged) per Step 14 of docs/plans/2026-04-28-oci-local.md ("Caproni integration (cherry-pick from MR !59 (merged))"). They live in the downstream branches today as a stale leftover from a foundation cherry-pick that was undone in f7cda56.
• internal/datastore/migrations/sql/*.sql: domain-specific schema, stays in MR-2.
• internal/format/oci/testdata/fuzz/...: fuzz seed corpus, stays in MR-4.
• scripts/conformance/* and the conformance:oci CI job: coupled to cmd/registry, stays in MR-5.
• go.mod / go.sum: kept with the code that consumes the deps so each downstream MR is independently go mod tidy-clean.

Test plan

• CI green on this MR (build, vet, lint:markdown, lint:links, buf:lint, buf:generate-check, buf:breaking).
• lint:migration-ordering, lint:migrations, test:bench-regression, test:fuzz, test:integration, jet:generate-check all skip via changes: rules (no Go, SQL, or migrations changed).
• go build ./..., go vet ./..., go mod tidy are no-ops locally (verified).
• buf lint and buf generate are no-ops against the committed gen/ (verified).