feat: select guest kernel from image label

[sjmiller609]

Summary

• persist OCI image labels in Hypeman image metadata
• honor io.kernel.kernel-version during instance creation when it matches a supported kernel artifact
• fail fast on unknown labeled kernels and cover the new behavior with focused tests

Testing

• go test ./lib/images ./lib/system ./lib/instances -run 'TestParseKernelVersion|TestResolveCreateKernelVersion|TestDockerSaveTarballToOCILayoutRoundtrip|TestDockerSaveToOCILayoutCacheHit|TestExtractMetadataSucceedsOnBuildKitCache'

---

Note

Medium Risk
Changes instance boot configuration by allowing images to override the guest kernel via an OCI label, and expands system startup work to ensure all supported kernels are present; mistakes could cause instance creation/boot failures for labeled images.

Overview
Adds end-to-end support for persisting OCI image labels into Hypeman image metadata (extract from OCI config, store in metadata.json, and expose on images.Image).

During instance creation, honors io.kernel.kernel-version to select a supported guest kernel artifact (otherwise uses the default) and fails fast on unsupported values. System setup now ensures all supported kernel versions are downloaded/available, and new tests cover label extraction, kernel parsing, and kernel selection behavior.

^{Written by Cursor Bugbot for commit 32d4e43. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}