Support `msb load`

[appcypher]

Summary

Support importing OCI/Docker image archives into the local image cache via msb load, similar to docker load. This enables offline workflows and air-gapped environments where pulling from a registry isn't possible.

What docker load does

docker load imports an image from a tar archive (typically created by docker save). The archive contains the image manifest, config, and all layer blobs — everything needed to reconstruct the image locally without contacting a registry.

Proposed behavior

$ msb load < myimage.tar
   ✓ Loaded        myimage:latest

$ msb load --input myimage.tar
   ✓ Loaded        myimage:latest

The command would:

1. Parse the tar archive (OCI image layout or Docker archive format)
2. Extract layer blobs into the local layer store as EROFS disk images
3. Register the image manifest and config in the local cache
4. Make the image available for msb run without a registry pull

Formats to support

• OCI Image Layout — the standard format (oci-layout marker + blobs/ + index.json)
• Docker archive — the legacy format produced by docker save (manifest.json + layer tar balls)

Both formats are tar archives containing self-describing metadata, so detection can be automatic.

Counterpart: msb save

For completeness, msb save would export a cached image to a tar archive:

$ msb save myimage:latest > myimage.tar
$ msb save --output myimage.tar myimage:latest

This is the inverse operation and completes the offline image transfer workflow.

Dependencies

This feature depends on the completion of the OCI image filesystem overhaul (#499), which moves the layer store from host-filesystem extraction to EROFS disk images. The load path needs to convert imported layer tarballs into the same EROFS format used by the registry pull path.