Move to the signed OCI/ECR sifter (sifter-build v1), superseding the v2 migration

[danl-aisi]

Move to the signed OCI/ECR sifter (v1 + signing), not sifter v2

Point isambard-containers at the sifter distribution that is actually shipping:
the v1 sifter with the OCI/ECR registry backend + cosign signing, released under
the renamed distribution sifter-build (import package and CLI stay
sifter). This supersedes #4 (the sifter v2 migration), which is parked — v2
is the longer-term successor, and this is the fast path to a signed registry now.

Because sifter v1's public API is unchanged (the port only renamed the
distribution and added the OCI/ECR backend), no application code changes are
needed — serve.py, run_benchmark.py, and the demos keep using the same
find_latest_container / resolve_container / get_jobs API. The change is:

• pyproject.toml: depend on sifter-build instead of sifter (same import
  name), sourced from the sifter repo.
• sifter.yaml / README: registry guidance is now the signed OCI/ECR registry
  (SIFTER_REGISTRIES) rather than S3; the registry is selected by environment,
  so nothing in the manifest hardcodes it.
• uv.lock: regenerated.

Verified on an Isambard login node: sifter-build installs, the tools import
against it, and push/pull to the real ECR registry round-trips with cosign
sign-on-push and verify-on-pull (fail-closed on a bad/absent signature).

For review

• Depends on the unmerged sifter PR (branch dan/oci-ecr-signing); the
  [tool.uv.sources] git ref points at that branch. Once it merges, drop the
  branch= so it tracks the default branch.
• Close Upgrade to sifter v2 #4 when this lands — the two can't coexist (both would resolve a package
  called sifter-build).

🤖 Generated with Claude Code