Add staging-pull and pull the core through ghcr in the test

[alexadereyko]

Depends on:

• Add staging-push workflow to push stagings to ghcr #7

Brief

Add staging-pull, a reusable workflow that resolves requested staging packages in an OCI registry (ghcr) to digests, pulls them as tarballs, and uploads them as an artifact.

Description

The input is a list of artifacts to produce, each with this structure:

deps: >-
  [
    {
      "artifact": "dep-core-ubuntu-22.04-x86_64-ninja-gcc-release",
      "packages": [
        {
          "path": "ghcr.io/opendaq/test/staging/hello-core",
          "tag": "<sha>",
          "annotations": {
            "org.opencontainers.image.title": "*-x86_64-linux-gcc-11-release.tar.gz"
          }
        }
      ]
    }
  ]

• artifact — the name of the artifact to upload.
• packages — the packages the artifact is assembled from; each is resolved against its index and every matching child is pulled into it.
• path / tag — the package path (its OCI index) and the tag that picks a specific index.
• annotations — how the child is resolved. In the general case a child is picked by its org.opencontainers.image.title (the file name). All values are globs, so you match on exactly the fields you care about — pin the compiler where it's deterministic, leave it open where the runner owns it (*-macos-apple-clang-*). For a more precise resolve, use com.opendaq.* annotations (present when the staging carried a staging-meta.json).

The workflow fetches the index at path:tag and matches each child's descriptor annotations against the globs in a single request — no per-child manifest fetch. A request with no match is "not found" and fails; every match is pulled by digest — more than one is fine — but two pulled artifacts may not share a file name, since they'd clobber each other in the artifact, which fails loudly. The pulled tarballs and a manifest.json (what was resolved: path, tag, digest, title, annotations) go into the artifact, so the build can pin by digest. One matrix job per entry uploads one artifact.