add --image-format flag to pin output media type

[mzihlmann]

fixes #849.

Kaniko's output media type is currently decided by whatever the base image happens to be, with a Docker schema2 fallback. That is outside the user's control and changes silently when a registry re-publishes a tag in a different format, which makes the output format unpredictable. This adds --image-format=docker|oci so the output format is an explicit, stable choice. The format is forced at a single chokepoint in newStageBuilder, so it propagates to every stage including FROM scratch and subsumes FF_KANIKO_OCI_SCRATCH_BASE.

This is phase 1 of the migration: the flag is purely additive and the unset default keeps today's inherit-from-base behavior, so existing builds are bit-for-bit unchanged. The default flip to oci is a later phase tracked on #849.

[codecov]

Codecov Report

❌ Patch coverage is 34.14634% with 54 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
pkg/image/transform.go	25.49%	33 Missing and 5 partials ⚠️
cmd/executor/cmd/root.go	14.28%	3 Missing and 3 partials ⚠️
pkg/executor/build.go	53.84%	4 Missing and 2 partials ⚠️
pkg/config/options.go	63.63%	4 Missing ⚠️

📢 Thoughts on this report? Let us know!

[mzihlmann]

Moving back to draft. applyImageFormat only sets the manifest and config media types, it does not touch the layer descriptors. mutate.MediaType and mutate.ConfigMediaType leave manifest.Layers[] alone, and only the layers kaniko appends get converted to the image vendor, base layers never pass through convertLayerMediaType.

So forcing --image-format=oci on a docker schema2 base gives an OCI manifest with docker base-layer descriptors, and forcing docker on an OCI base gives the reverse. Both are the hybrid manifest that strict readers like dockle reject, the same problem as mz851 from the other direction. This is the open question the design proposal already flagged.

The fix is to relabel every layer descriptor too, not just the manifest and config. The relabel is descriptor-only and compression-preserving so blob bytes and digests do not change, with the one caveat that a zstd OCI base cannot be represented in a docker manifest and has to error rather than convert. The mz851 work added a WithMediaType wrapper in pkg/image that does exactly this. We should share it here so the format selector and the reproducible path use one correct relabel instead of two partial ones.