Block a user
Respect USER directive from OCI image config
Respect the OCI
USER config field (Dockerfile USER directive)
Inject universal /slim/init instead of requiring container-specific setup
refactor: split main.rs into registry, build, and qemu modules