[deveshctl]

Images can grow while remaining 100% layer-efficient, and the current compare verdict does not enforce image-size limits. This adds opt-in size budgets shared by CI and comparison, plus a clearer comparison report that leads with totals, failed checks, and the largest changes.

size-budget:
  max: 500MB
  max-growth: 5%

• Explicit null and blank YAML size limits are rejected before image analysis; omitted limits remain disabled. Numeric byte counts and aliases are supported.
• CLI overrides: --max-image-size and --max-growth; CI growth checks require --baseline OLD.
• Measures complete uncompressed layer-tar bytes consistently across supported Docker/Podman exports and archives. Existing stored-blob export fields retain their meaning; analysis JSON adds explicit size/platform fields in schema 1.0.2. Analysis cache schema is bumped to rebuild old measurements.
• Compares shared layers by full uncompressed hashes; uniquely matching commands are explicitly labelled, and unrelated layers are not paired by index. File comparisons remain metadata-based, with that limitation visible in reports.
• Adds terminal-aware summaries, ranked layer/file/waste changes, directory summaries, theme-aware terminal styling, and JSON/Markdown check reports. Preserves existing regression exit behavior and the final text verdict line.
• Shows the configured absolute budget in the viewer, including at 80 columns. Updates starter configs, help, documentation, and changelog.
• Fixes a live-test failure also reproduced on main: explicit-platform local build tags were always pulled. Scoped inspect now verifies matching local variants before reuse; missing or mismatched variants still pull. Progress output is drained before the final digest line.

Validation:

• Full Linux go test -race -count=1 -p 2 ./... passed with no exclusions in the official Go 1.27.3 container; additional race checks passed for final CLI/viewer changes.
• Windows build, vet, and tests passed with three existing Windows-specific cache/rename tests excluded. The full Linux run includes those tests.
• golangci-lint 2.14.0: zero issues.
• Builds passed for linux/darwin/windows on amd64 and arm64.
• All three archive fuzz targets passed 10-second smoke runs.
• 28 actual CLI archive/configuration/exit-code scenarios passed, including compression-independent cold/cache measurements, exact boundaries, missing baselines, platform mismatch, config discovery and overrides, report formats, and legacy analysis exports.
• Eight live Docker Engine 29.6.1 scenarios passed: cold/cache analysis, archive equivalence, absolute/growth limits, explicit platform, actual docker-save input, and a scratch build through layerx build with analysis export.
• Ran the interactive viewer and comparison in an 80-column terminal; added layout regressions. Final diff check passed.

Podman was not installed locally, so live Podman coverage remains for CI; existing mocked engine/resolver tests passed. macOS and Windows arm64 were cross-compiled, not runtime-tested.