Add the org.opencontainers.image.title annotation to layer descriptors
in attestation manifests to enable tools like 'oras pull' to download
attestation bundles with meaningful, collision-free filenames.
The annotation format is {algorithm}-{hex}.sigstore.json where the
hyphen separator ensures cross-platform filename compatibility,
particularly for Windows which forbids colons in filenames.
Changes:
- Add Annotations field to layer descriptors in WriteReferrer
- Update tests to verify annotation is set correctly
- Document the optional layer annotation in BUNDLE_SPEC.md
Fixes#4497🤖 Generated with [Claude Code](https://claude.com/claude-code)
Signed-off-by: Ralph Bean <rbean@redhat.com>
Co-authored-by: Claude <noreply@anthropic.com>
37cf1bc499