build: omit empty :tag / @digest segments when rebuilding oci-layout ref

[SAY-5]

Summary

Fixes #3793.

resolveBuildContext concatenated the parsed oci-layout ref back into a FrontendAttr via:

target.FrontendAttrs["context:"+k] = "oci-layout://" + storeName + ":" + tag + "@" + dig

When the user passed a digest-only context (oci-layout:///path@sha256:...), ocilayout.Parse returned tag == "", so the concat produced oci-layout://<storeID>:@sha256:.... The downstream frontend's reference parser rejects the empty : segment with invalid reference format. The regression arrived in v0.33.0 alongside the oci-layout parse refactor.

Fix

Build the attr piecewise: only append ":" + tag when tag is non-empty and "@" + dig when digest is non-empty. Tag-only (:1.3) and tag+digest refs retain their existing serialization.

Test plan

• go build ./build/... clean
• go vet ./build/... clean
• go test ./build/... ./util/ocilayout/... green (existing TestParse already covers the digest-only Parse case; this fix lives in the re-serialization step, which has no unit-level harness — the frontend contract is what enforces it, and the issue reporter's repro now goes through).
• Manual: docker buildx build --build-context proxy=oci-layout:///some/layout@sha256:<digest> . no longer errors with invalid reference format.

[crazy-max]

Thanks for working on this and for taking the time to put together. We ended up moving forward with a repo-native follow-up in #3811 and #3812 so we can land the change in the shape we want, with the test coverage and integration coverage aligned with the rest of the codebase.

Because of that, I'm going to close this PR so the work stays consolidated in one place. We appreciate the report and the attempted fix.