Step-by-step TDD plan for the push image-archive subcommand and the
push bundle detection hook. Broken into 18 bite-sized tasks covering
archive reader, command wiring, validation, push loop, documentation
and e2e coverage with concrete code for every step.

Refs: https://jira.nutanix.com/browse/NCN-113655

Introduce the images/archive package with the Format enum that will
drive archive type detection for the upcoming push image-archive
subcommand.

Refs: NCN-113655

Detect scans tar headers once at the root level looking for
oci-layout or manifest.json markers, returning FormatUnknown when
neither is present. This primitive will be used by push bundle to
short-circuit with a helpful error when the user points it at an
image archive.

Refs: NCN-113655

Introduce the Archive interface and Entry struct that will carry a
v1.Image or v1.ImageIndex with an optional embedded reference.
Open() detects the format and routes to docker or OCI readers;
readers currently return 'not implemented' and are fleshed out in
follow-up commits.

Refs: NCN-113655

Parse manifest.json from a docker-save tarball and emit one Entry
per RepoTags value. Untagged entries are also surfaced with a nil
Ref so the caller can apply a destination tag override.

Refs: NCN-113655

Read OCI image layout tarballs through archives.FileSystem with no
disk extraction. Blobs are served on demand via an fs.FS-backed
partial.CompressedImageCore; image indexes are returned as a small
v1.ImageIndex implementation. The reference name (if any) is taken
from the org.opencontainers.image.ref.name annotation on the
top-level descriptor.

Refs: NCN-113655

Adds unit coverage for multi-arch OCI indexes (v1.ImageIndex) and
for both OCI and docker archives containing zero images, which the
command layer treats as a no-op rather than an error.

Refs: NCN-113655

Register the cobra command with its full flag set (image-archive,
to-registry, TLS/auth, image-tag); the RunE body is a stub that
returns nil and will be implemented alongside the push logic.

Refs: NCN-113655

Open each --image-archive argument up front (expanding globs) and
enforce the precondition that --image-tag is only valid with a
single archive containing a single image. The override is also
validated as a strict OCI reference. Push is still a no-op and is
added in a follow-up commit.

Refs: NCN-113655

Wire up the TLS/auth plumbing (mirroring push bundle), resolve each
archive entry's destination reference using the embedded tag or
--image-tag override, and push images via remote.Write / image
indexes via remote.WriteIndex. End-to-end unit tests cover both
docker-save and OCI layout archives via an in-process go-containerregistry
registry.

Refs: NCN-113655

Adds a regression test ensuring that pushing an archive which
contains no embedded tag and no --image-tag override produces a
clear error that mentions --image-tag so the user knows how to
unblock themselves.

Refs: NCN-113655

Before extracting bundle configs, inspect each --bundle path with
archive.Detect and abort with a pointer to push image-archive when
the file is actually an OCI or docker image archive. This replaces
the confusing silent no-op (or unrelated extraction error) users
previously saw.

Refs: NCN-113655

Use containers/image reference.Parse (without Docker Hub
normalization) for --image-tag so that a single-segment override
like "override:v3" is pushed to the destination as "override:v3"
rather than being normalized to "library/override:v3". Embedded
tags continue to use ParseNormalizedNamed to strip any registry
host and preserve legacy Docker Hub semantics.

Refs: NCN-113655

Cover OCI layout push, docker-save push, push bundle detection
against an image archive, multi-image docker-save push, the
--image-tag override on a tagless OCI archive, and a DescribeTable
over TLS variants (loopback plain-HTTP, TLS with CA file, insecure
TLS, and explicit http scheme) mirroring the push bundle e2e
coverage.

Refs: NCN-113655

Wrap the in-process go-containerregistry registry with a
basic-auth gate via httptest.Server and assert that the correct
credentials succeed while mismatched credentials fail. Exercises
the --to-registry-username / --to-registry-password plumbing
without requiring an htpasswd-capable test registry.

Refs: NCN-113655

Describe the new subcommand, its supported input archive formats,
tag resolution behaviour, and the --image-tag override.

Refs: NCN-113655