chore(release): cut v1.5.3

[deveshctl]

Cuts the v1.5.3 release. Moves the [Unreleased] changelog section to [v1.5.3] - 2026-07-16 and bumps the README version-pin examples.

Highlights

Added

• Page and half-page navigation in the file tree and layers pane: Ctrl-d / Ctrl-u (half screen), Ctrl-f / Ctrl-b and PgDn / PgUp (full screen), alongside the existing g / G and j / k motions.
• --config PATH persistent flag to point any subcommand at a specific .layerx.yaml, regardless of the working directory.

Changed

• .layerx.yaml discovery now walks up the directory tree from the current working directory to the filesystem root, then falls back to the XDG / %AppData% config path.
• The Docker resolver honours DOCKER_CONFIG; the Podman resolver honours PODMAN_CONNECTIONS_CONF and CONTAINERS_CONF.
• Archive auto-detection uses os.Lstat, so a symlink named like an image reference is no longer mistaken for an archive.
• The cache-entry validator requires exactly 64 lowercase hex characters after sha256:, preventing cache prune from touching unrelated directories.
• When no container engine is reachable, the error now points at archive mode; the interactive error screen wraps long messages to the terminal width.
• Clearer disk-space hints and a consistent layerx: stderr prefix on the --json write confirmation.

Security

• Layer analysis caps each decompressed layer at 16 GiB, closing a gzip-bomb path in the analysis flow.
• Archive descriptors (manifest.json, image config, legacy root *.json) are capped at 64 MiB and reject headers that overstate their size.
• The image-save stream from an engine is capped at 64 GiB while spooling to a temp file.

Fixed

• File extraction no longer overwrites a dangling symlink at the destination; the filename is bumped instead.
• Daemon-unreachable and image-not-found detection no longer misfire on generic filesystem errors or the bare substring "not found".

See CHANGELOG.md for the full list.