fix: round-9 review findings — pull errors, efficiency, config, Esc

[deveshctl]

Address findings from the pre-merge code review for the round-9 fix branch.

What changed

image/efficiency.go

• indexTree now admits hardlinks at every DiffType. The previous round-9 fix only admitted Modified and Removed, so a path that was whiteout-deleted and then reintroduced as a hardlink (which Stack emits as DiffType=Added) silently dropped the prior real-file bytes from the waste total — exactly the regression class the round-9 fix claimed to close, just for the Added variant.
• LayerCount now counts only byte-contributing occurrences. The size=0 hardlink replacement extends the run so the prior real occurrence is charged, but the user-facing 'across N layers' count must reflect layers that actually shipped real bytes.
• Comment rewritten to describe what the code does (extend the run) rather than what it doesn't ("terminate the run" was wrong — pathRuns only flushes on Removed).

image/docker.go

• Empty-errorDetail fallback now includes Code and Status. Registries that emit terse error events (Code=401 with empty Message, or just a Status='Retrying in N seconds') previously surfaced as a generic pull failed (registry returned an empty error) with no diagnostic.
• progress==nil callers (CI, JSON export) now skip per-event layer bookkeeping. Pre-round-9 those callers used io.Copy(io.Discard); after the round-9 unification they were paying for map updates whose output was immediately discarded.

config/config.go

• Replace the goccy-specific io.EOF guard with a TrimSpace+comment-strip pre-check via a new hasYAMLContent helper. Library-agnostic, handles the truncated-document edge case (where goccy might return EOF after a partial decode and silently drop user values), and survives goccy version bumps.

tui/model.go + README.md

• Loading screen now renders Press q or Esc to exit so the round-9 Esc-state-machine comment and CHANGELOG bullet stop describing a hint that wasn't there. Previously only the error screen rendered the hint.
• README TUI keybindings table updated to describe Esc as dismiss-only, matching the Breaking change announced in CHANGELOG.

Test rigor (CLAUDE.md PR-discipline rule #3)

• TestEfficiency_RegularFileReplacedByHardlink_IsWasted now pins Score (0.5) and LayerCount (1) so future regressions in walkLiveFiles or the LayerCount semantics break the test.
• TestEscapeQuitsInStateLoading/InStateError now assert m.fetchCtx.Err() == context.Canceled, pinning the quit-cancels-everything contract documented at model.go cancelInflight.

Deferred

The reviewer flagged a few larger architectural concerns that are intentionally not part of this PR (per CLAUDE.md rule #4 — no drive-by changes):

• Replacing the hand-rolled streamPullProgress with moby's Stream.Wait (preserves errdefs typing).
• Reworking the eager errorDetail return to tolerate transient daemon retries.
• Restructuring the Esc cascade so the stateReady gate sits at the top rather than the bottom.
• Widening walkFiles to admit hardlinks so hardlink-only-in-input paths are reachable.

Each is a feature-sized change deserving its own PR.

Verification

• go build ./... clean
• go vet ./... clean
• gopls check on touched files clean

🤖 Generated with Claude Code