mise oci: support apk entries in [bootstrap.packages] (Wolfi bases)

[adonm]

Hi! Thanks for mise oci - the one-layer-per-tool model is exactly what we want for our build images, and the apk bootstrap support from #10476 is great.

Would it be possible to let mise oci build use apk: entries in [bootstrap.packages] alongside the current apt: support?

Today the OCI builder rejects them:

mise ERROR mise oci currently supports only apt entries in [bootstrap.packages]; unsupported manager(s): apk

The use case: building images on Wolfi (glibc-based, apk-managed), which is otherwise a perfect fit for mise oci - it avoids the musl issues the docs warn about for Alpine while giving us the rolling security posture. Right now we have to pre-build a small base image with apko just to get system packages in, then layer tools with mise on top. If the OCI build wired apk through the same path as apt (unpack base rootfs -> apk add --root), a Wolfi-based image would be a single mise.toml.

Not urgent - the apko base workaround is fine - but it would remove the last non-mise step from the Wolfi flow. Happy to test any branch.

[jdx]

Implemented in #12083.

This adds native apk: OCI package layers for Alpine/Wolfi bases using apk --root, preserves the existing reproducible rootfs diff flow, supports version pins, and annotates the layer as dev.mise.system.packages=apk. I tested it against cgr.dev/chainguard/wolfi-base:latest by installing jq and verifying the generated layer payload.

One current constraint: apk executes package scripts in a chroot, so this path requires a Linux host running as root with apk on PATH. The PR includes explicit errors and documentation for those requirements.

Thanks for offering to test this.

AI-assisted — Tool: Codex; model: openai/gpt-5; version: unavailable.

[adonm]

Tested and confirmed working! Thanks =)