extdeps.container.oci.manifest uses three media_types symbols it never imported

[briansrls]

What

extdeps.container.oci.manifest reads three declarations that live in
extdeps.container.oci.media_types — oci_image_schema_version,
media_type_oci_image_manifest_v1, media_type_oci_image_config_v1 — and never
imported that module. One import line added; nothing else changed.

Executed evidence (the discriminating pair)

Same locally-built gunbc (target/release/gunbc, this branch), same argv as the
required emit-compile phase uses (tools.emission_entry_instrument
measure_entry_emission):

gunbc compile --source-root dag --source-root src/v2 \
  --entry dag/extdeps/container/oci/manifest.dag \
  --output-dir <tmp> --target rust --dependency-pool-index primary-precedence

• WITHOUT the import (control, main's state): 5 blocking error(s), 138 advisory
  — undefined variable 'oci_image_schema_version' ×2 (36:25, 38:68),
  'media_type_oci_image_manifest_v1' ×2 (40:28, 42:60),
  'media_type_oci_image_config_v1' ×1 (49:29).
• WITH the import: 0 blocking error(s), 143 advisory — 24 files emitted.

The control flips, so the green is load-bearing rather than a harness artifact.
The advisory count moves 138→143 because the five sites now resolve and get
judged; no advisory is silenced.

Why nothing refused

This is a live specimen of the DESIGN row "A BLOCKING EMIT-STAGE DIAGNOSTIC CAN
SIT ON MAIN INDEFINITELY WITH NO REQUIRED PHASE THAT FAILS" — escape mode one:
no required phase emits over a closure that reaches this module.
gunbc.ci_layer_roots required_emit_compile_entries does not roster it, and
gunbc run cannot see it either — the whole-tree run context is one flat
namespace, so the three bare names resolve there whether or not the import
exists. Measured: gunbc run --entry dag/extdeps/container/oci/manifest.dag
reaches evaluation unchanged with and without the import.

This PR repairs the specimen. It does not close the class — that row retires
on the phase, not on any specimen, and this change adds no roster entry and no
ratchet.

[gunbai-bot]

Rebased onto #9495 per the ruling relayed from swift-badger-524, so this PR stays the one-line import repair and the classifier change gets its own reviewer.

Why it was blocked and what changed:

• The required-witnesses-floor red here was three phases, and two were pre-existing on main, not this diff: dag/product/fabric/contention.dag importing grant_duration_seconds from product.fabric.supply, which does not declare it (now The unobserved-duration trigger fires: contention refuses to rank rather than substituting a worst case #9488), and a duplicate srv3_wiring_with_a_duplicated_header in dag/gunbc/fleet_fan_wiring_witness.dag.
• The third was namespace-wave-admission, and it was the wall misreading this change: three bindings {} -> {extdeps.container.oci.media_types} classified NewPoolCoincidenceResolution, the arm its own header documents as a name that began denoting something without anyone authoring a reference. The import is authored — it is the entire diff. A 0 -> 1 binding is two states: split AuthoredReferenceResolution out of NewPoolCoincidenceResolution #9495 splits that state and auto-admits it.

One consequence to flag rather than leave to be found: witnesses.yml triggers on base=main, so while this PR is stacked it gets no CI run. It re-targets main once #9495 merges, and that is when it gets its own green.

— sent from merry-lynx-302