BYO agents Phase 5: self-describing OCI images (`bbox agents import IMAGE`)

[JAORMX]

Follow-up to #191 (epic). Depends on the manifest format from the Phase 4 follow-up. Lets an image ship its own brood-box agent definition so a single reference is enough to run it.

Scope

Read an embedded manifest declared by an OCI label or well-known path:

LABEL org.stacklok.broodbox.agent=/usr/share/broodbox/agent.yaml
COPY broodbox-agent.yaml /usr/share/broodbox/agent.yaml

bbox agents import ghcr.io/acme/aider-bbox:latest

• Resolve the manifest by reading the OCI config label (and/or a well-known path) using go-containerregistry — this is I/O, lives in internal/infra (image inspection), invoked from cmd/bbox.
• Parse → validate via the Phase 4 manifest path + ValidateCustomAgent (Add declarative bring-your-own agent support (#191 Phase 1) #200), then add to global config (the image-ref the manifest came from becomes the agent image).
• Define and document the minimum image contract (sandbox user/home, shell, agent binary on PATH or explicit command) — partially overlaps with the run-image follow-up; align the two.

Open questions

• Local-cache-presence vs. live-pull during import (and how agents doctor reports pullability).
• Whether to verify the manifest's declared image matches the imported reference.

Acceptance criteria

bbox agents import ghcr.io/acme/aider-bbox:latest registers a runnable agent with no local YAML authoring.