fix: skeleton packages included only one architecture per component

[yohanb]

Description

When publishing a skeleton package, PackageDefinition resolved imports using the host machine's architecture as the
filter. This meant that multi-arch source packages (where the same component name appears once per architecture, e.g.
two zarf-injector entries; amd64 & arm64) had all but the host arch variant silently dropped during import
resolution.

Consequently, a skeleton published from an amd64 machine would only contain the amd64 variant of zarf-injector. An
arm64 user importing from that skeleton would fail to find a compatible component.

Changes

Variant dimension abstraction (load.go)

Introduced VariantDimension (VariantArchitecture, VariantFlavor) and SkipVariantFilters []VariantDimension
on DefinitionOptions. Callers pass the dimensions they want to retain; load.PackageDefinition passes them
straight through to resolveImports without any skeleton-specific logic or sentinel values.

publish.go passes SkipVariantFilters: []load.VariantDimension{load.VariantArchitecture} when publishing a
skeleton, keeping the load package free of skeleton-specific knowledge.

Multi-arch import resolution (import.go)

• resolveImports and compatibleComponent accept skipVariantFilters []VariantDimension instead of relying on
  the SkeletonArch sentinel. When VariantArchitecture is skipped, every arch variant of a matching component
  is collected instead of filtered to one.
• When multiple components with the same name are found and VariantArchitecture is not skipped, the existing
  "multiple components named X found" error is returned (non-skeleton behaviour unchanged).

Arch-qualified tarball naming (import.go)

fetchOCISkeleton now looks for <name>-<arch>.tar before falling back to <name>.tar, so each arch variant
of a component resolves to its own layer in the OCI skeleton.

Related Issue

Fixes #4446

Testing

Unit tests (src/pkg/packager/load/import_test.go):

• TestResolveImportsVariantDimensions: verifies that skipping VariantArchitecture includes both amd64 and arm64
  variants; amd64/arm64 filters each include only their respective variant.
• TestCompatibleComponent: new cases covering skip-arch-only, skip-flavor-only, and skip-all-filters, ensuring
  each dimension works independently and in combination.

Local end-to-end test against the zarf source itself (which has both k3s and zarf-injector as two-variant multi-arch
components):

• ./dist/zarf-fixed package publish . oci://localhost:5001 --plain-http --skip-version-check
• ./dist/zarf-fixed package inspect definition oci://localhost:5001/init:unset-development-only --plain-http -a skeleton

Published skeleton contains both amd64 and arm64 variants of k3s and zarf-injector. metadata.architecture: skeleton
is set correctly.

Backwards compatibility

fetchOCISkeleton falls back from <name>-<arch>.tar to <name>.tar when the arch-specific layer is absent.
Skeletons published before this fix continue to work; they just can't provide the previously-missing arch variants.

Checklist before merging

• Test, docs, adr added or updated as needed
• Contributor Guide Steps followed

[netlify]

✅ Deploy Preview for zarf-docs ready!

Name	Link
🔨 Latest commit	17ad898
🔍 Latest deploy log	https://app.netlify.com/projects/zarf-docs/deploys/6a7b43e77484380008e5a029
😎 Deploy Preview	https://deploy-preview-5146--zarf-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[codecov]

Codecov Report

❌ Patch coverage is 56.94444% with 31 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/pkg/packager/load/import.go	50.98%	19 Missing and 6 partials ⚠️
src/internal/api/v1alpha1/validate.go	66.66%	2 Missing and 1 partial ⚠️
src/pkg/packager/assemble/assemble.go	40.00%	2 Missing and 1 partial ⚠️

Files with missing lines	Coverage Δ
src/pkg/packager/load/load.go	71.50% <100.00%> (+0.81%)	⬆️
src/pkg/packager/publish.go	63.29% <100.00%> (+0.19%)	⬆️
src/internal/api/v1alpha1/validate.go	88.57% <66.66%> (-1.14%)	⬇️
src/pkg/packager/assemble/assemble.go	55.14% <40.00%> (-0.14%)	⬇️
src/pkg/packager/load/import.go	52.83% <50.98%> (-0.43%)	⬇️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.