builder, oci: split network-free packages out of the engine
opam resolves packages whole, so depending on any sub-library of builder or oci pulled the package's entire dependency set: runc, seatbelt and sqlite from the builder engine, and the requests/TLS/HTTP registry client from oci. A consumer that needs only the build model or the local OCI layer cache inherited the whole execution and network surface.
Extract the network-free cores into their own packages so they can be consumed without that surface: oci-layer (spec, local store, layer build), builder-spec (spec, plan, runtime, backend), builder-graph (the build DAG) and builder-opam (the opam binary-layer cache and solver). The engine and registry client now depend on these.