Refactor data model to support more atomic index generation

This adjusts our data model to store/track data from the registry as an image index (with more data fidelity) instead of as a custom data structure.  One of the most notable benefits is that we can now track the annotation objects for each architecture, but even more importantly, this allows us to generate the indexes we need to push in deploy directly from data that's on-disk (where the old structure would require querying the registry).

Notably, however, this does *not* change deploy (yet) -- those changes are still in progress, but this was a large enough refactor/rewrite that I figured I should start here.

This also switches us from using containerd's registry client library to using [`cuelabs.dev/go/oci/ociregistry`](https://pkg.go.dev/cuelabs.dev/go/oci/ociregistry), which is much closer to the distribution-spec APIs (modeled/designed after them, in fact), where containerd's (and frankly most others) are a higher-level abstraction.  This is important because we're running into raw number of request rate limits, and almost every library for this always starts with a `HEAD` before pushing content, and this will allow us to go directly for a `PUT` (and then only do the "copy child objects" dance if the `PUT` fails).

This also drops our `allTags` data entry (which we only *ever* used the first value of, and then only to identify a `sourceId`/`buildId` in a human-meaningful way, because it's not useful/meaningful for any other use case), and moves `tags` from being arch-specific up to the per-source-object level because it's always identical across all arches for a given `sourceId` so it's silly to copy it N times for every architecture object.

.any-go-nt.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+# usage: if ./.any-go-code-nt.sh builds; then expensive-docker-run-command ... go build -o builds ...; fi
+
+shopt -s globstar
+
+for go in **/**.go go.mod go.sum; do
+	for f; do
+		if [ "$go" -nt "$f" ]; then
+			exit 0
+		fi
+	done
+done
+
+exit 1

.go-env.sh

@@ -20,11 +20,16 @@ args=(
 
 	--env "CGO_ENABLED=${CGO_ENABLED-0}"
 	--env "GOTOOLCHAIN=${GOTOOLCHAIN-local}"
+	--env GODEBUG
 	--env GOFLAGS
 	--env GOOS --env GOARCH
 	--env GO386
 	--env GOAMD64
 	--env GOARM
+
+	# hack hack hack (useful for "go run" during dev/test)
+	--env DOCKERHUB_PUBLIC_PROXY
+	--env DOCKERHUB_PUBLIC_PROXY_HOST
 )
 if [ -t 0 ] && [ -t 1 ]; then
 	args+=( --tty )