DEN-266: certify configurable cache layout and package-backed OCI build inputs #335

Recovered requirements ZED-CACHE-LAYOUT and ZED-OCI from the August 8–September 8 Chat audit. Private source/disposition ledger: ORESoftware/my-ai#119. Message aliases: M067, M076, M194, M271, M294. Existing registry fallback work in zed-infra#30/#31/#45 and full platform work in zed-pkg/.github#61 remain canonical and must not be duplicated.

Cache layout

• Specify configurable registry/org/project/version identities, including project-optional paths, compatible with existing config/cache users.
• Prove collision resistance across registries, organizations, targets and versions; preserve immutable store semantics and safe symlink/copy-mode behavior.
• Add a versioned migration/dry-run plan rather than silently moving or deleting user files.

OCI build input integration

• Resolve build inputs through immutable Zed package/version/digest identities and produce reproducible multi-platform artifacts.
• Define package-to-OCI provenance and integrity/fallback semantics; coordinate zed-infra#34 for provider canaries without treating that as the package-build implementation.
• Test clean installation/build, wrong digest/version/architecture, missing private authority and deterministic rerun behavior.
• Document interoperability honestly; third-party inclusion in GitHub Packages' product list is not an outcome the implementation can guarantee.

Closure

Link existing implementing PRs first where these exact criteria already hold. Otherwise open bounded implementation PRs with tests and retain exact source/package/image identities. This issue is a recovered acceptance gap, not a claim that the cache or OCI product is absent or complete.