feat(oci): upstream assembly and memoized lookups (S32 plan: 10b/19)

What this does

Assemble container virtual upstreams from the ordered datastore result.

The assembly drops soft-deleted associations, prefetches lookup results, installs request state, and builds lazy remote flights. It also adds read-only memo adapters for lookup, health, and outage-cache reads.

Decisions a reviewer should check first

• The normal cache store remains live. Only serveOutage uses the prefetched outage-cache memo. This preserves the current-row read after a coalesced 304.
• The assembly puts request state on the context passed to Resolve. A prefetch-only context would leave remote resolution without the per-position URL, image name, and client Accept values.
• A wrong kind or format, missing remote binding, malformed URL, or invalid auth status creates a data-error position. The resolver can then withhold a false 404 and report the exclusion. A row with both a malformed URL and an invalid auth status reports the URL cause, which is first in the spec's cause list.
• The health memo fails closed when the assembled context has no health map. It does not issue a per-position store read.

Spec coverage

Requirement	Evidence
Assemble hosted and remote positions in order	internal/format/oci/virtual_assembly.go; TestVirtualUpstreamAssembly_*
Do not consult soft-deleted positions	TestVirtualUpstreamAssembly_SoftDeletedAssociationIsDroppedBeforeEveryGate; TestVirtualUpstreamAssembly_AllSoftDeletedListAnswersNoUpstreams; integration coverage
Use each remote row's URL and request image name	TestVirtualUpstreamAssembly_*; integration coverage
Keep the read path at 2 + K statements	TestVirtualUpstreamAssembly_*Statement* integration coverage
Memoize health without a store read	TestVirtualUpstreamAssembly_TwentyRemotePositionsIssueNoHealthStatement
Preserve real-cache reads outside outage fallback	virtual_memo.go; virtual_memo_test.go
Classify each data-error cause through the assembly	TestVirtualUpstreamAssembly_MixedDataError*; TestVirtualUpstreamAssembly_AllIneligibleAnswersInternal
Keep memo reads safe under concurrent resolution	virtual_memo_test.go concurrent-reader coverage

Size

This MR changes 5,528 lines because it includes the complete virtual assembly, memo adapters, unit and integration harnesses, property coverage, and focused sidecars.

• Production Go: 1,061 lines
• Tests: 4,181 lines
• Documentation: 286 lines

Checks

• go test ./internal/format/oci ./internal/virtual
• The pre-commit suite passed with the repository dummy GCS credentials.
• git diff --check origin/main...HEAD
• No e2e scenario is added or affected: the assembly has no production caller until the serve surface (Step 12) and composition root (Step 14) land.

Plan scope

The separate plan amendment !2866 (merged) records the virtual_hosted_lookup.go scope clarification.

Related to #291 (closed)