refactor(oci): remove out-of-scope feature-authoring publish/upload code

[pofallon]

Summary

The feature/template authoring commands were already removed from deacon, but the OCI publish/upload implementation still lived in crates/core/src/oci/ with no path reachable from any binary — every caller was a test. This violates the consumer-only constitution (§II "Consumer-Only Scope"), under which feature authoring (test/info/plan/package/publish) is permanently out of scope. This PR deletes the dead authoring code entirely.

Removed

• fetcher.rs: publish_feature, publish_template, publish_feature_multi_tag, publish_collection_metadata, upload_blob, upload_blob_generic, upload_blob_template, upload_manifest, upload_manifest_template
• types.rs: the PublishResult struct (+ its re-export in oci/mod.rs)
• progress.rs: ProgressEvent::OciPublishBegin / OciPublishEnd variants and their id() / timestamp() match arms
• observability.rs: spans::REGISTRY_PUBLISH and registry_publish_span()
• client.rs: the publish-only HttpClient::put_with_headers / post_with_headers trait methods and every impl/mock (ReqwestClient, MockHttpClient, and the in-tree test mocks in integration_oci_auth.rs and oci_timeout.rs). All callers were inside the deleted upload functions.
• Tests: publish-only tests in integration_fake_registry.rs (the push/pull cycle) and integration_oci_enhancements.rs (the test_publish_feature_multi_tag_* set), plus the test_publish_collection_metadata_* inline tests in oci/mod.rs. Consumer tests (list_tags, get_manifest, semver utils) are retained.
• Stale file: crates/core/src/oci.rs.old — an uncompiled, git-tracked backup left over from the original oci.rs → oci/ split, containing the same authoring code.

Out of scope / untouched

The consumer-side fetch/pull/install path — fetch_feature, download_layer, get_manifest*, get_manifest_by_digest, list_tags — is unchanged. No errors.rs publish/upload variants existed. No test binary was fully deleted, so .config/nextest.toml needs no changes.

Acceptance

grep -rn across crates/ returns no hits for publish_feature, publish_template, publish_collection_metadata, publish_feature_multi_tag, OciPublish, PublishResult, REGISTRY_PUBLISH, registry_publish_span, put_with_headers, post_with_headers, upload_blob, or upload_manifest.

Gates (run locally against this tree)

• cargo fmt --all -- --check — pass
• cargo clippy --all-targets --all-features -- -D warnings — pass
• cargo deny check — advisories/bans/licenses/sources ok
• Retained OCI consumer tests pass (deacon-core integration_fake_registry, integration_oci_auth, integration_oci_enhancements, oci_timeout, and the oci unit tests).

Known pre-existing failures (NOT caused by this PR, reproduce identically on main)

• make test-nextest does not run to completion because deacon::integration_cli::test_debug_logging_with_subcommand fails on a stale workspace-path error-message assertion. This is unrelated to OCI/publish code and is being fixed separately in build: raise MSRV to 1.95 to restore the MSRV CI gate #166.
• cargo +1.85 check (MSRV) fails on pre-existing lockfile drift (transitive deps now require rustc ≥ 1.86). Also fails on main; out of scope here.

🤖 Generated with Claude Code