fix(spur-net): OCI puller assumes all layers are gzip — zstd and uncompressed layers fail

[shiv-tyagi]

Problem

In pull_and_extract() (spur-net/src/oci.rs), the extraction condition media_type.contains("gzip") || digest.starts_with("sha256:") is always true (all digests are sha256), routing every layer through GzDecoder. For zstd-compressed layers (application/vnd.oci.image.layer.v1.tar+zstd) or uncompressed layers (…layer.v1.tar), GzDecoder fails with an invalid gzip header error.

The docker save path in image.rs is more robust — it checks magic bytes (0x1f, 0x8b) and falls back to plain tar. The OCI path has no such detection.

Neither path supports zstd decompression.

Expected Behavior

• Detect layer compression from mediaType and/or magic bytes
• Support gzip, zstd, and uncompressed tar layers
• Remove the meaningless digest.starts_with("sha256:") fallback

Acceptance Criteria

• Layer decompression selected by mediaType with magic-byte fallback
• Uncompressed tar layers (…layer.v1.tar) extracted correctly
• Zstd layers (…tar+zstd) extracted correctly (requires zstd crate)
• sha256: digest check removed from extraction gate
• Consistent detection logic between OCI pull and docker save import paths