fix(ci): verify registry upload against exported OCI config

README.md

@@ -248,7 +248,7 @@ Publication uses checksum-pinned regctl v0.11.6 with 8 MiB blob requests to
 avoid monolithic layer uploads exceeding reverse-proxy limits. Both images are
 exported and uploaded sequentially; temporary archives and credentials are removed
 on exit. The runner needs curl, sha256sum and temporary disk space for one Docker
-image archive. The remote image config digest is checked against the local image
+image archive plus its extracted OCI layout. The remote image config digest is checked against the locally normalized archive
 after each upload. A proxy must still allow the OCI registry PATCH/PUT endpoints.
 
 For this repository the image base is