Ingest a stratum. The caller supplies digests READ BACK FROM GHCR — never locally computed.

docker push compresses with its own settings, so a locally re-compressed layer lands in the registry under a DIFFERENT digest. An index built from local tarballs describes blobs that exist nowhere, and the registry then silently serves bytes itself instead of redirecting.