fix: prove public registry visibility without daemon cache

[wms2537]

Summary

• exchange an anonymous GHCR pull token and fetch the exact digest-addressed manifest
• reject tag references, malformed or oversized streaming token responses, and digest-header mismatches
• run the authoritative check after registry logout and before the Docker smoke pull
• add regression coverage for workflow ordering and public-registry failure modes

Why

The alpha.2 release exposed a false-positive boundary: a fresh Docker client config can still reuse an authenticated daemon cache. The published package remains private, and this check now fails correctly until package visibility is made public.

Evidence

• Exact commit: ab6b1daa9bf1ce1ddb09cf9e7cada053257342eb
• Focused tests: 13/13 passed
• Exact release gate: passed
• Evidence: release-evidence/2026-07-22T09-41-10-978Z
• Independent review caught and verified a streaming body-limit fix; current external GHCR visibility remains separately incomplete

Relates #25.