Materialize a package locally (no registry round-trip) and run a command in its env

Usage: ocx package test [OPTIONS] --identifier <IDENTIFIER> [LAYERS]... [-- <COMMAND>...]

Arguments:
  [LAYERS]...
          Layers, in order (base first, top last). Same syntax as `package push`: either a path to a `.tar.gz`/`.tar.xz`/`.tar.zst` archive, or `sha256:<hex>.<ext>` referring to a layer already present in the target registry. Digest refs are auto-pulled from the registry on demand; in `--offline`, missing digest blobs error with `PolicyBlocked`.
          
          A layer may carry an optional layout tail `:strip=N,prefix=P` (`strip=N` drops N leading path components; `prefix=P` relocates the layer under the relative subdirectory `P`), e.g. `./libs.tar.gz:strip=1,prefix=share`.

  [COMMAND]...
          Command to execute inside the composed env, with arguments. Required unless `--script` is given (exactly one of the two forms must be supplied).
          
          `last = true` (mirroring `run.rs`'s `argv`) makes clap parse everything before the mandatory `--` into `layers` and everything after into `command`. Without it, `command` is an ordinary positional sitting after the optional `layers` (index 1), which trips clap's debug-assert "non-required positional with a lower index than a required positional" - fatal in debug builds when the command tree is built (e.g. completion generation). Requires clap >= 4.5.57 (see `run.rs` NOTE).

Options:
  -m, --metadata <METADATA>
          Path to the package metadata JSON file. Defaults to a sibling of the first file layer (e.g. `pkg.tar.gz` -> `pkg-metadata.json`). Required when no file layers are provided.
          
          This must be the compiled form `ocx package create --metadata` writes, with every dependency pinned to a digest; an authoring sidecar with tag-only dependencies is rejected. The build receipt is anchored to the bundle, so pointing this flag elsewhere does not move where an omitted `--platform` is read from.

  -p, --platform <PLATFORM>
          Target platform (e.g. `linux/amd64`). An explicit value is used as given. Omit it to take the platform the build receipt beside the bundle recorded; a usage error (exit 64) when neither names one. Parity with `package push`

  -o, --output <OUTPUT>
          Materialize into DIR instead of an auto-managed temp dir. DIR must not exist (created by ocx) or be empty. Implies keep - the dir is never deleted by ocx. Must reside on the same filesystem as `$OCX_HOME/layers/` - hardlink assembly does not fall back to copy

      --keep
          Preserve the temp build directory after the command exits. Path is printed to stderr. Default temp root is `$OCX_HOME/temp/test/`

      --self
          Compose the package's private env surface (default: interface surface). Same semantics as `ocx exec --self` / `ocx env --self`

      --clean
          Strip ambient parent env before composing - only `OCX_*` config and composed package vars reach the child. Mirrors `ocx exec --clean`

      --env <KEY[:TYPE[:SEP]]=VALUE>
          Set an environment variable for this invocation, as `KEY[:TYPE[:SEP]]=VALUE`.
          
          Repeatable; a later `--env` for the same key wins. The value is split on the FIRST `=`, so `--env FOO=a=b` sets `FOO` to `a=b`. Values are literal - no interpolation.
          
          `TYPE` is `constant` (replace the existing value), `path` (prepend to it) or `list` (append to it), and defaults to `constant`. A relative `path` value resolves against the current directory, so `--env PATH:path=node_modules/.bin` puts a project-local directory in front of the composed `PATH`. Without `:path` a `PATH` override replaces the composed value outright, dropping every package directory.
          
          `SEP` is the string a `list` contribution is joined to the existing value with, as in `--env GODEBUG:list:,=gctrace=1`. It accepts any text, including a colon. Omitted, the key takes whatever separator another contributor to it declared, or a single space if none did.
          
          Applied last, so it overrides every package-declared variable - and, for the project toolchain, the project's `[env]` and any selected group's `[env]` as well.
          
          A bare `--env FOO` (pass the ambient value through) is not accepted; keys matching `OCX_*` or `__OCX_*` are rejected; so is a `TYPE` outside `constant`, `path` and `list`, a `SEP` that is empty or that qualifies any type but `list`, and a `list` value starting or ending with its own separator. All exit 64.

  -i, --identifier <IDENTIFIER>
          Identifier under which the package is materialized. Tag form (`repo:tag`) only; an explicit `@digest` is rejected (the digest is computed locally during this command and supplying one would conflict)

      --script <SCRIPT>
          Path to a Starlark test script. Mutually exclusive with the trailing command. When given, the materialized package env is interpreted by the embedded engine instead of exec'ing a command.
          
          The value `-` reads the script SOURCE from stdin (parsed with the filename label `<stdin>`). This is independent of the per-call `ocx.run(stdin=...)` kwarg, which feeds a *child* process's stdin.

  -h, --help
          Print help (see a summary with '-h')
