add push to oci registries

[monotek]

add push to oci registries

Closes #183.

Adds a new cr push command that uploads every chart package in --package-path
to an OCI registry. Built on top of helm.sh/helm/v3/pkg/action.NewPushWithOpts
— the same code path the helm push CLI uses — so behavior, auth handling, and
provenance support stay in lockstep with Helm.

This is an independent distribution channel: cr push does not touch the
gh-pages branch, the index.yaml, or GitHub Releases. Users can run OCI-only
or dual-publish alongside cr upload.

What's new

• cr push command. Iterates *.tgz files under --package-path and
  pushes each to <registry-url>/<chart-name>:<chart-version>. Sibling
  *.tgz.prov files (from cr package --sign) are picked up automatically.
• Auth: --username / --password flags (also CR_USERNAME /
  CR_PASSWORD via the existing viper env-binding); falls back to the
  registry credential store (~/.docker/config.json, populated by
  helm registry login or docker login).
• TLS: full set of flags — --plain-http, --insecure-skip-tls-verify,
  --ca-file, --cert-file, --key-file.
• Idempotent re-runs: --skip-existing resolves each chart's OCI ref
  against the registry and skips ones already present. Mirrors
  cr upload --skip-existing semantics. Default is off (matches helm push).
• Strict scheme check: requires oci:// prefix on --registry-url and
  errors out with a helpful message otherwise.

Usage

cr package mychart/
cr push \
  --registry-url oci://ghcr.io/myorg/charts \
  --username "$GITHUB_ACTOR" \
  --password "$GITHUB_TOKEN" \
  --skip-existing

Follow up

chart-release-action update: helm/chart-releaser-action#234