v9.4.0 — OCI media types end to end (composefs/bootc#1703 fix) Every image the catalog builds is now OCI (application/vnd.oci.image.manifest.v1+json + application/vnd.oci.image.config.v1+json) instead of Docker schema2 (v2s2). bootc's composefs backend re-reads the image config blob at `bootc install` and again on day-2 `bootc upgrade`/`switch`; a v2s2 image fails that read (bootc-dev/bootc#1703, and the adjacent #2318) — "GetBlob ... file does not exist" at install, "blob unknown to registry" on day-2. Install had a local-OCI-staging workaround (--source-imgref oci:...); day-2 had none, so registry-direct upgrades were blocked outright. Native OCI media types remove the failing read at the source: the config blob is a proper OCI config the composefs backend can materialize, so install and day-2 both work registry-direct with a bare image ref — no local OCI staging, no --source-imgref. Changed: - base-build-scratch, seal, container-build, and supply-chain's shared .buildah_job template (which instance's build extends) set BUILDAH_FORMAT=oci (was docker). buildah's own upstream default is OCI. The dialect is set at BUILD and never converted after gating, so the digest the gates test is the digest promoted. Copies (promote, skopeo copy) preserve. Added: - Permanent OCI media-type assertion (creep-detector) so a v2s2 image can never regress into a promoted tag. base-build-scratch promote asserts each candidate layer is OCI (manifest + config) before moving :stable/:latest, on the exact digest smoke/smoke-sb tested; seal asserts the sealed artifact is OCI, read locally from containers-storage before push. Minor bump: published images change media type v2s2 -> OCI; layer contents and layer digests are unchanged.