Conflation between OCI labels and annotations

[jeckersb]

This came up in a chat.

We use the OCI annotation keys org.opencontainers.image.created and org.opencontainers.image.version, however at a glance it looks like we're inconsistent on whether we use those keys when looking at actual annotations, or rather looking at the labels on the container. Those are not the same thing. Quick AI-assisted dump of some places this comes up:

---

Instances of annotation constants used to query labels

File	Line	Constant	Queried from
crates/lib/src/status.rs	205	ANNOTATION_CREATED	config labels
crates/lib/src/install/aleph.rs	55	ANNOTATION_CREATED	config labels
crates/ostree-ext/src/container/mod.rs	490	ANNOTATION_VERSION	config labels

Correct usages (for comparison)

File	Line	Constant	Queried from
crates/ostree-ext/src/container/store.rs	597	ANNOTATION_CREATED	manifest annotations
crates/lib/src/bootc_composefs/status.rs	514	ANNOTATION_VERSION	manifest annotations

Additional observations

1. ANNOTATION_VERSION is less problematic in practice because the write-side in crates/ostree-ext/src/container/encapsulate.rs:265-318 intentionally writes the version to both config labels and manifest annotations. And for non-ostree-ext-built images, Dockerfiles typically use LABEL org.opencontainers.image.version=..., so it ends up in labels anyway.

2. ANNOTATION_CREATED is the more problematic one. The encapsulate code does not write it into labels — it only sets config.set_created(). So the label lookup at status.rs:205 and aleph.rs:55 will almost never match; they're saved by the fallback to config.created().

3. There's an inconsistency between the ostree and composefs code paths. The composefs status code (bootc_composefs/status.rs:514) correctly reads ANNOTATION_VERSION from manifest annotations, while the ostree status code (status.rs:211 via version_for_config) reads it from config labels. These could diverge for images where the value is only in one location.