Pure-Elixir OCI artefact push to ghcr.io.

Implements just enough of the OCI Distribution Spec push flow to publish one nbpr tarball as an OCI image manifest with a single layer:

1. Auth: GET /token with Basic auth (<username>:<token>) and scope repository:<image>:push,pull → bearer token.
2. For each blob (the tarball layer + the empty config object): POST /v2/<image>/blobs/uploads/ (Bearer) → 202 with Location: upload URL → PUT <upload-url>?digest=sha256:<hex> (Bearer, body) → 201.
3. PUT /v2/<image>/manifests/<tag> (Bearer, JSON body, manifest Content-Type) → 201.

Credentials

Reads from GHCR_TOKEN (preferred) or GITHUB_TOKEN env vars. The username is from GHCR_USERNAME, defaulting to "oauth" (irrelevant for token-based auth — the registry validates the token, not the user).

In GitHub Actions, GITHUB_TOKEN is auto-injected; setting GHCR_USERNAME to ${{ github.actor }} is conventional but not required.