[deckhouse-cli] Add pull summary after d8 mirror pull

[Glitchy-Sheep]

[mirror] Add an end-of-pull summary to d8 mirror pull

ℹ️ What

Prints a short, framed summary at the end of every d8 mirror pull (and --dry-run):
what was pulled (or, in dry-run, what will be) - platform, installer, security databases,
modules and packages.

A --verbose-summary flag adds a per-module and per-package breakdown with their resolved versions.

❓ Why

Before this, a pull ended with hundreds of Pulling ...@sha256:... lines and no recap.
To learn the one thing we actually need - which releases, module and package
versions will be mirrored (and whether the bundle is complete) - you had to scroll the log.

The original ask was exactly that: in --dry-run, see which platform release and which
module/package versions will be pulled, honouring all filters (--include-module /
--exclude-module / --include-package / --no-platform / --include-platform / ...),
without reading sha lines.

📝 How it works

• Each phase (platform / installer / security / modules / packages) records what it
  resolved/pulled - versions, VEX attestations, bundle sizes - from data the pull
  already has. No extra registry requests.
• Counts are taken before packing (packing deletes the layouts as it tars them).
• The summary renders on every outcome, so you always see what landed:
  • success and dry-run,
  • Ctrl+C -> partial summary, marked cancelled,
  • a hard failure (e.g. network died) -> partial summary, marked FAILED, then the error.
    A phase that never ran shows not pulled.
• Colour is semantic and only when attached to a terminal; pipes and files get plain text
  (set FORCE_COLOR=1 to force colour into a file).

---

📊 What the summary shows

• Edition - the source edition (CE/EE/...), parsed from the source path; omitted for
  a custom registry with no edition segment.
• Platform - the release version(s), and how many channels they map to.
• Installer - its tag (latest or a pinned --installer-tag).
• Security - N/M databases (green when complete, yellow when partial).
• Modules - module count and the total VEX; with --verbose-summary, each module's
  versions and VEX count.
• Packages - same as modules, for Deckhouse packages: package count and total VEX; with
  --verbose-summary, each package's versions and VEX count.
• Bundle (real pull) - each artifact with its size and chunk count, plus a TOTAL.
  Package archives (package-<name>.tar, the shared package-versions.tar) are listed here
  automatically.

Versions are sorted newest-first (semver) everywhere they appear.
(See examples below)

---

🔄 Before / after

Before - the run just ended with the streaming log; no recap:

... [318/319] Pulling registry.../modules/code@sha256:...  succeeded
... [319/319] Pulling registry.../modules/code@sha256:...  succeeded

Pull packages

FORCE_COLOR=1 d8 mirror pull \
      --source dev-registry.deckhouse.io/sys/deckhouse-oss \
      --no-platform --no-security-db --no-modules --no-installer \
      --include-package 'boardmaps@>=0.0.0' \
      --include-package 'cossacks-server@>=0.0.0' \
      --verbose-summary \
      <bundle-dir>

Different platform

FORCE_COLOR=1 d8 mirror pull \
      --source registry.deckhouse.ru/deckhouse/ee \
      --include-platform '>=v1.71.0 <v1.76.0' --no-modules --dry-run --verbose-summary \
      <bundle-dir>

Dry-Run for Community Edition

FORCE_COLOR=1 d8 mirror pull \
      --source registry.deckhouse.ru/deckhouse/ce \
      --dry-run --verbose-summary \
      <bundle-dir>

Dry-Run for Enterprise Edition

FORCE_COLOR=1 d8 mirror pull \
      --source registry.deckhouse.ru/deckhouse/ee \
      --dry-run --verbose-summary \
      <bundle-dir>

---

✏️ Main changes

• New summary model and renderer (formatting only; emitted through the existing logger).
• Pull() now returns (*PullSummary, error) - always a non-nil summary, so a partial run
  (cancel or hard error) still renders instead of showing only a raw error.
• Per-phase Stats() that captures counts/versions before packing, for modules and
  packages.
• --verbose-summary flag (output only - it does not change what is pulled).
• Counting helpers in pkg/registry/image (manifest count + a matched subset for VEX).
• Two latent bugs fixed while wiring this up: platform AsList() returned empty (reflection
  looked for the wrong field type), and dry-run under-counted module versions.

---

ℹ️ Also: packages mirroring no longer crashes on registries without packages

While adding the packages summary, surfaced and fixed a regression from the packages
mirroring support (#376): the packages phase failed the whole pull against any registry
that has no /packages repository - including the public registry.deckhouse.ru/deckhouse/ee
and /ce. The intended graceful-skip only matched ErrImageNotFound, but a missing repo is
reported as a NAME_UNKNOWN transport error.

Fix: treat NAME_UNKNOWN the same as ErrImageNotFound ("no packages here, skip the phase")
in both validatePackagesAccess and discoverPackageNames, mirroring the already-graceful
PullPackageVersions. With this, a pull against a packages-less registry succeeds and the
summary simply shows Packages: 0 packages.

---

🧪 Tests

• Unit: rendering in every state (dry-run / cancelled / failed / not-pulled / verbose / VEX /
  versions) for modules and packages, semver sorting, colour gating, the counting helpers,
  and outcome classification.
• Packages Stats(): dry-run accounting and the before-packing capture (the count must
  survive packing).
• Regression for the graceful-skip fix: a missing /packages repo (both NAME_UNKNOWN and
  ErrImageNotFound) skips the phase instead of failing the pull.
• Verified end-to-end against real registries: dry-run and real pulls render the expected
  versions / VEX / sizes (including a real packages pull); the summary adds no registry requests.