Forward-merge changes from release/25.12 to main

[jameslamb]

Forward merges changes from #830 to main.

Created like this:

git fetch upstream release/25.12
git checkout main
git fetch upstream main
git checkout -b oci-types
git cherry-pick b863fa000b5cd52246b47d09125e2f7ca1be4379

Notes for Reviewers

Labeled breaking because this changes the media types of some image layers, which may cause issues for some docker versions (but hopefully not, because this switches to OCI-compliant types which should be MORE portable).

THIS SHOULD BE /merge nosquash merged

[bdice]

The /merge nosquash command only works if the branch name follows a specific pattern. Someone with admin power will have to do this no-squash merge manually. Otherwise LGTM.

[jameslamb]

Ah got it, I forgot about the branch name conventions for /merge nosquash.

Thanks for merging this @gforsyth