Improve OCI offline caching for tag lists and manifest variants

[andrew]

PR #199 makes cached image pulls work when the registry or token service is unavailable, but two narrower offline-cache gaps remain:

• /v2/{name}/tags/list is always proxied upstream. After warming the cache, disable the upstream registry and request the tag list. The request fails instead of serving a cached or stale response.
• Manifest cache keys include the raw Accept header. Warm a manifest with one Accept ordering, disable the upstream registry, then request the same reference with a compatible reordered or differently spaced value. The cache key differs, so the offline request can miss an otherwise usable cached manifest.

Cached tag listings should support stale fallback. Compatible manifest media-type requests should share cached variants without serving a representation the client did not accept.

Observed on PR #199 at 52a02c3, based on main at bbea63f. These are follow-ups and should not block PR #199.