dew images: show repo locations (.meta sidecar) — #71 Part B

[vedanta]

Follow-up to #71 (Part A shipped dew images with name/project/size/last-packed/owner — all derivable, no sidecar change).

Part B adds the one field that needs persistence: the source repo's filesystem path (the image doesn't know where its repo lives).

Plan (per the decision recorded in #71)

• Widen the per-image ownership marker <image>.id → a <image>.meta sidecar (yaml): id, project, repo_path, packed_at.
• pack writes .meta (recording the repo path); the ownership check (Pack-time repo-binding: prevent cross-repo image clobber #70) reads .meta's id, falling back to .id for images packed before the upgrade.
• dew images gains a repo-path column, flagging stale paths ((moved?)) when the recorded path no longer exists.

Caution

This touches the security-critical ownership path (#70), so test the .id→.meta migration + fallback carefully. Keep .meta local-only (never synced). Treat it as a co-located cache, not source of truth — the filesystem (image + manifest) stays authoritative.

[vedanta]

Lower-risk design note (use this when implementing)

The original plan widens <image>.id → <image>.meta and changes the cross-repo ownership check (#70) to read .meta. That touches the security-critical clobber-guard path.

Prefer instead: leave <image>.id exactly as-is and add a separate, inventory-only <image>.meta sidecar holding repo_path (recorded by pack from cwd). dew images reads .meta for the location; the ownership check keeps reading .id, untouched. Two small sidecars, but the security path is fully isolated — making this a low-risk change.

Note packed_at is redundant (the image file mtime already gives "last packed"), so repo_path is really the only field worth persisting. Keep .meta local-only (never synced).