push: use the local manifest.json from package/harden as the source of truth instead of regenerating annotations

[friedrichwilken]

Problem

push still rebuilds a separate Unified OCI manifest with placeholder model configuration and defaults. When --manifest is supplied, its annotations currently win, but the generated manifest remains misleading:

• --manifest-output is not the exact manifest pushed.
• The generated defaults can be used when no manifest is supplied.
• Package/harden output is not automatically treated as the canonical artifact.

Proposal

Make the manifest and config.json produced by package and updated by harden the source of truth for push.

• With --manifest, use its annotations and adjacent config.json as-is. push may add only push-owned data, such as creation metadata, provenance referrers, and explicit --relationships.
• Remove invented metadata defaults from push, including accelerator, CUDA, MOF class/components, framework, and license.
• When --manifest is omitted, prefer <model-path>/manifest.json when it exists; otherwise require explicit metadata rather than inventing values.
• Make --manifest-output contain the exact manifest sent to the registry.

Acceptance

After:

model-cli package --model test-model --model-path ~/test-model \
  --artifact test:v1 --accelerator cpu --registry oras --registry-url ""

model-cli harden --model test-model --model-path ~/test-model \
  --artifact test:v1 --mof-class III

then:

model-cli push --artifact test:v1 --destination localhost:5000 \
  --registry oras --model-path ~/test-model \
  --manifest ~/test-model/manifest.json

oras manifest fetch localhost:5000/test:v1 preserves the local annotations, including accelerator=cpu, mof.class=III, and the detected/declared MOF
components. Add an end-to-end test that asserts local and registry annotations are equal.