master
switch to ESM and update config/test wiring
harden buildx scoped config path handling
test: cover Docker Hub OIDC with registry-auth
log Docker Hub OIDC token exchange progress
switch from jest to vitest