feat: migrate from oras-go v2 to v3

[TerryHowe]

Summary

• Replace all oras.land/oras-go/v2 imports with github.com/oras-project/oras-go/v3
• Update API call sites for breaking changes in v3 (credential types, repository struct fields, reference access, login/logout functions)
• Add blank import of registry/remote/config package to register the config loader required by v3

Key API Changes

v2	v3
auth.Credential{}	credentials.Credential{}
auth.EmptyCredential	credentials.EmptyCredential
client.Credential =	client.CredentialFunc =
credentials.Credential(store)	store.Get
credentials.Login/Logout	remote.Login/Logout
repo.Client/PlainHTTP/HandleWarning	repo.Registry.Client/PlainHTTP/HandleWarning
repo.Reference.Registry	repo.Registry.Reference.Registry
repo.Reference.Repository	repo.RepositoryName
repo.Reference (field)	repo.Reference() (method)
ref.Reference (field)	ref.GetReference()
SetReferrersCapability() returns error	no return value

Test plan

• go build ./... succeeds
• go test ./... all pass
• go vet ./... clean

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 94.59459% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 87.22%. Comparing base (54b7e29) to head (dd31789).

Files with missing lines	Patch %	Lines
cmd/oras/internal/option/remote.go	88.88%	0 Missing and 1 partial ⚠️
cmd/oras/root/logout.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2002      +/-   ##
==========================================
+ Coverage   87.18%   87.22%   +0.04%     
==========================================
  Files         143      143              
  Lines        5539     5541       +2     
==========================================
+ Hits         4829     4833       +4     
+ Misses        423      422       -1     
+ Partials      287      286       -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[TerryHowe]

A migration plan document has been added at docs/proposals/oras-go-v3-migration.md covering remaining work beyond this PR's mechanical API renames.

Summary

Remaining deprecation fixes (bugs / code duplication):

#	Task	Files	Impact
1	oci.New() → oci.NewStorage() in cache — fixes process-safety bug for shared ORAS_CACHE	option/cache.go	bug fix
2	Delete internal/cache/ — use oras-go/content/cache (already ships this logic)	internal/cache/, option/cache.go	−100 lines
3	Replace custom handleWarning() sync.Map logic with remote.NewWarningLogger()	option/remote.go	−25 lines
4	Replace internal/trace/transport.go with remote.NewLoggingTransport() via ClientBuilder.Logger	internal/trace/, option/remote.go	−160 lines

New v3 features to implement:

#	Task	Benefit
5	ClientBuilder + properties.Registry in NewRepository()/NewRegistry()	Consolidates 40+ lines of manual TLS/retry/auth plumbing
6	config.LoadConfigs() full ecosystem config stack	Automatic Podman auth.json, per-registry TLS from certs.d, registry mirrors from registries.conf
7	oras.CopyError structured error handling in cp/push/pull/attach	Distinguishes source vs destination failures in error messages

Steps 3 and 4 require a small slog→logrus bridge (internal/logutil/bridge.go, ~15 lines) since v3's warning/logging APIs use *slog.Logger and ORAS currently uses logrus.

Steps 5+6 are the most impactful: adopting config.LoadConfigs() unlocks mirrors and Podman credentials for users with no CLI changes needed.

Full implementation order and code sketches are in the proposal doc.