fix: stop masking fsync failures in the image store

[kacy]

summary

third of the four-PR hardening pass — the targeted error-handling sweep.
the audit found ~264 catch {} and ~165 catch unreachable, but the
large majority are legitimately benign (idempotent migrations,
best-effort temp cleanup, writes to disconnected peers, sleeps that only
fail on cancellation). this PR fixes the ones that actually mask a
real fault: silently-swallowed fsync failures in the image store.

what's in here

four sync() catch {} → catch |err| log.warn(...) in the blob/layer
write path:

• image/layer/create.zig — layer tar fsync
• image/registry/blob_transfer.zig — downloaded blob fsync
• image/store/blob_runtime.zig — blob copy + blob store fsync (×2)

a swallowed fsync means a durability failure (disk full, IO error) goes
unnoticed until a later read finds a corrupt/missing layer. content
addressing still guards correctness on read; this adds the early signal
at write time.

deliberately not touched (and why)

• idempotent schema migrations (addColumnIfMissing ... catch {}) —
  "column already exists" is the expected benign case
• best-effort temp-file cleanup on error paths — leaving a temp file
  is harmless
• best-effort client writes in reverse_proxy — the peer is often
  already gone; logging every disconnect would be noise
• sleep(...) catch unreachable — fails only on cancellation, not
  reachable from external input

a blanket sweep of all 264 sites would be high-churn and risky for no
real safety gain; this stays surgical.

verification

• YOQ_SKIP_SLOW_TESTS=1 zig build test — 2235 passed, 0 failed
• tools/panic_audit.sh clean; zig fmt --check clean