mz851: keep reproducible output a consistent dockerv2 manifest

[mzihlmann]

Fixes #851

A reproducible build always canonicalizes the image to dockerv2, since mutate.Canonical rebuilds it on an empty docker base. With FF_KANIKO_REPRODUCIBLE_PRESERVE_BASE_LAYERS the ReplaceBase splice then put the pristine OCI base layers back on top of that docker manifest, so the result was a docker schema2 manifest carrying OCI layer descriptors. That hybrid is malformed and strict readers such as dockle reject it.

The preserved base layers are now relabeled to their dockerv2 media type as they are spliced, which is a descriptor-only change that keeps each layer blob and digest intact. A base layer that has no digest-preserving docker form (zstd) has its preservation skipped with a warning, falling back to the recompressed canonical layer. A new assertion at the push chokepoint fails the build if the output manifest ever mixes OCI and docker media types, and the mz851 reproducible integration test exercises an OCI base so this path is covered.

[codecov]

Codecov Report

❌ Patch coverage is 69.44444% with 11 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
pkg/image/transform.go	72.72%	7 Missing and 2 partials ⚠️
pkg/executor/build.go	33.33%	1 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!