feat: port the image machinery from ecr

ecrou's workspace starts from ecr's confinement-neutral half: image
reference resolution, the content cache with digest freshness, layer
extraction with whiteouts and deferred directory modes, provisioned
hot cells, and the progress/error/config plumbing. Adaptations: the
cache lives in ~/.cache/ecrou, the namespace-era error variants and
utils constants are gone, KvmUnavailable arrives ahead of its caller,
rootfs loses its exec() delegation, and uname(2) goes through libc
now that nix is no longer a dependency. The CLI crate is a stub until
its commit.

crates/ecrou-cli/Cargo.toml

@@ -0,0 +1,27 @@
+[package]
+name = "ecrou-cli"
+description = "Enter one-shot microVM environments"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+authors.workspace = true
+
+[[bin]]
+name = "ecrou"
+path = "src/main.rs"
+
+[dependencies]
+ecrou = { path = "../ecrou" }
+
+# CLI parsing
+clap = { version = "4", features = ["derive", "env"] }
+
+# Error handling
+anyhow = "1"
+
+# Logging facade; the stderr sink lives in src/logger.rs
+log = { version = "0.4", features = ["std"] }
+
+# Progress bar rendering of library progress events
+indicatif = "0.18"