Add load-image subcommand

[jasonmadigan]

What

Add oinc load-image <ref> to load a locally built container image into the cluster's CRI-O store, the kind load docker-image equivalent. Consumers building derived images for e2e currently hand-roll this; kuadrant-backstage-plugin carries oinc/load-image.sh doing exactly it (Kuadrant/kuadrant-backstage-plugin#348). Substrate plumbing belongs in oinc.

Related: #13 (rhdh addon consumes this for custom-image installs), #15 (skopeo pre-bake is the prerequisite).

Design (proven working in the consumer script, absorb it)

• Detect the host runtime as the owner of the oinc container (docker on GitHub runners; the podman-first probe order elsewhere in oinc mismatches there).
• Stream, do not copy files around: <runtime> save <ref> | <runtime> exec -i oinc ... then skopeo copy docker-archive:/dev/stdin containers-storage:<ref> inside the container, or equivalent. Keep pipefail semantics across the stream.
• Preserve the ref exactly: localhost/<name>:<tag> refs must resolve for pods with imagePullPolicy: IfNotPresent and an empty registry in chart values.
• Verify with crictl images and fail loudly if the ref is absent after import.
• Idempotent: re-loading the same ref succeeds.
• Depends on skopeo being present in the oinc image (Pre-bake skopeo into the oinc image #15). Until that ships, keep the consumer-style bounded-retry dnf install as a fallback, then delete it.

Acceptance criteria

• oinc load-image localhost/some-image:tag from the host lands the image in CRI-O; a pod using that ref with IfNotPresent starts without a registry
• Works with docker and podman as the host runtime
• Nonzero exit and a clear message when the image is missing host-side or the import fails
• Re-running with the same ref is a no-op success
• Smoke-tested in this repo's CI (build a trivial image, load, run a pod from it)
• README documents the subcommand