[fluxxBot]

• All tests passed. If this feature is not already covered by the tests, I added new tests.
• All static analysis checks passed.
• Appropriate label is added to auto generate release notes.
• I used gofmt for formatting the code before submitting the pull request.
• PR description is clear and concise, and it includes the proposed solution/fix.

---

Docker image id verification: fix OOM, make slow path opt-out
PR #410 introduced daemon.WithUnbufferedOpener() in containerManager.Id() to stop the Docker push flow from OOMing on large images — daemon.Image(ref) buffers the entire docker save tarball in memory. That change fixed the OOM but caused a second regression: on Docker 29 (which most customers now run) and on resource-constrained agents, the unbuffered opener stalls the push for 5+ minutes on multi-GB images. During that stall the jf docker push appears hung, sitting between the Pushed line from the Docker daemon and the subsequent Setting properties... build-info step.

The root cause is daemon.Image(...).Manifest() invoking a full docker save over the whole image just to read the config digest. On Docker 29 the docker images --format {{.ID}} fallback cannot be used because it now reports the manifest digest, not the config digest, so we can't cheaply substitute it.

What this PR does?
Two changes, both scoped to the Docker-client path inside containerManager.Id():

Replace WithUnbufferedOpener with WithFileBufferedOpener — spools the docker save stream to a temp file instead of RAM, permanently removing the OOM risk without needing any flag. Memory usage stays bounded regardless of image size.
Add a Push-only opt-in to skip the local id lookup entirely via a new env var JFROG_CLI_SKIP_DOCKER_IMAGE_ID_VERIFICATION. When set to a truthy value on a docker push, Id() short-circuits and returns an empty string; the build-info builder then adopts the Artifactory-side manifest's Config.Digest for layer lookups, bypassing docker save completely. Pull and all other flows ignore the flag and always verify.
Default behavior is unchanged: we still verify the local id, just with file-backed buffering instead of in-memory buffering.

Depends on:

1. RTECO-1052 - Fix docker performance jfrog-cli#3447

[github-actions]

---

🐸 JFrog Frogbot