Referenced-set signal + registry storage reclamation

[AlexHardAtWork]

Problem.*
OCM source packages are push-only; nothing reclaims registry storage.

Proposal.
Per ADR 015, the registry owns reclamation. Solar declares the
referenced set — the artifacts backing every retained live ComponentVersion
(green or red-but-not-yet-reaped), not only Release-referenced ones — and untags
the rest; the registry (Zot) reclaims blobs with its own GC. Solar does not
delete blobs directly. The set is fail-closed: a partial/failed computation
makes the registry retain, never reclaim, so registry GC can never outrun T2.
Sequence after T2 so an artifact is released only once its catalog entry is gone.

Acceptance criteria.

• Referenced set = every retained live ComponentVersion (green or red), not just Release-referenced.
• Fail-closed: partial/failed set → registry retains, never reclaims.
• No-longer-referenced OCM packages are untagged; blob reclamation deferred to Zot.
• Documented Zot GC configuration expectation.
• Never releases an artifact whose ComponentVersion still exists.