OCI distribution-spec conformance: Content-Length, digest validation, upload error codes

[m-ferrero]

Running this registry against the OCI distribution-spec conformance suite (sha256 path) surfaced a few small, independent gaps. I'd like to contribute a focused fix for each as its own self-contained PR, tracked here for the big picture. Each is minimal, ships with tests, and passes pnpm test on its branch.

• Preserve Content-Length on blob & manifest GET/HEAD. A client sending Accept-Encoding: gzip currently causes the response to switch to chunked transfer-encoding, dropping the Content-Length the spec requires. (Only visible at the real wire layer — e.g. Go net/http clients and the conformance suite.) → fix: preserve Content-Length on blob and manifest GET/HEAD #136
• Reject a by-digest manifest PUT whose content does not match the referenced digest — return 400 DIGEST_INVALID instead of storing it under the wrong key. → fix: reject manifest PUT whose digest reference doesn't match the content #137
• Return proper 4xx for upload errors instead of 500 — a wrong client digest on the finalizing PUT becomes 400 DIGEST_INVALID; zero-byte/empty blobs and a final chunk carried by the finalizing PUT are handled. → fix(upload): return 4xx for upload errors and handle empty/final-chunk blobs instead of 500 #138
• Fix mounted-blob HEAD to report the source blob's digest/size. This builds on the approach in fix(r2): return source digest/size for mounted blob HEAD responses #121 and corrects a defect in it (the checksum-mismatch test compares a raw ArrayBuffer to a hex string, so it never compiles and would misroute every digest-addressed blob). → fix(r2): report source digest/size for mounted-blob HEAD (builds on #121) #139 (credits fix(r2): return source digest/size for mounted blob HEAD responses #121)

And one related cleanliness item (not a conformance gap, but on the same content-negotiation strings):

• Single-source the manifest media-type constants. manifestTypes in src/registry/http.ts re-types literals that named constants elsewhere already hold (and one type — the OCI image manifest — has no constant at all), so the same content-negotiation string lives in two places and an edit could silently diverge one copy from the spec. A pure, behavior-preserving refactor that builds the list from named constants. → refactor: build manifestTypes from named media-type constants (de-duplicate literals) #140

Scope note: SHA-512 is intentionally out of scope (an optional algorithm in the spec); these target the sha256 path. Happy to split, squash, or reorder any of these to whatever is easiest to review.

In case it's handy: each PR applies to main on its own, and they barely interact — the only shared spots are test/index.test.ts (each adds its own tests) and the blob-HEAD handler in src/router.ts (touched by the Content-Length and mounted-blob changes).