FIPS-validated build of the ORAS (OCI Registry As Storage) CLI. Same surface as the standard oras image, compiled against the Go-FIPS toolchain and BoringCrypto so cryptographic operations (TLS to the registry, signature verification) run in a FIPS 140 mode.