[abn]

Adds aetherpak deltas backfill, a repair path for an existing image pair. Stacked on #177.

What changed

• deltas backfill --to-digest <digest> --from-digest <digest> generates delta layers from existing images and republishes the delta manifest and index entry without pushing the images again.
• Repeat --from-digest for multiple sources. A bare hex digest is accepted as sha256.
• --dry-run generates the delta without publishing it or retaining source tags.
• Source retention works as in a normal push, and the delta manifest carries the ordered source annotation.
• Emits target-digest, layers, smallest-bytes, and published.

Behavior

• Use it to repair a missing or lost delta, or to add a source to an existing target.
• It needs registry write credentials. --dry-run needs read access only.
• If no source produces a smaller layer, it exits successfully without changing the registry.
• The --backfill N history walk remains a follow-up. Sources are explicit digests for now.

Validation

• Tests publish a delta between two existing test-registry images and assert the manifest, source annotation, and index entry.
• A dry run generates a layer but writes no manifest or source tag.
• go test -race ./..., go vet, pre-commit, and integration pass.

Notes

• Action integration and a history-walk mode are follow-ups.