fix(backend): close the ReadCloser returned by PullBlob in push

[SAY-5]

Problem

pushIfNotExist pulls each blob's content from the source storage and
then hands it to Blobs().Push wrapped in io.NopCloser:

content, err := src.PullBlob(ctx, repo, desc.Digest.String())
if err != nil {
    return err
}

reader := pb.Add(prompt, desc.Digest.String(), desc.Size, content)
if err := dst.Blobs().Push(ctx, desc, io.NopCloser(reader)); err != nil {
    ...
}

The io.NopCloser is intentional: Close on the distribution reader
returns an error (see #50), so we don't let Push propagate that error.
But the wrapper also prevents the original content from ever being
closed. On both success and error paths, the underlying file descriptor
(or HTTP body) leaks for every blob we push, and Push is called once
per object in the image. #491.

Fix

Add defer content.Close() immediately after the nil-error check. The
existing NopCloser still prevents Push from calling Close on its
own, so the workaround for #50 is preserved. defer handles both the
success path and every early-return error path.

  content, err := src.PullBlob(ctx, repo, desc.Digest.String())
  if err != nil {
      return err
  }
+ defer content.Close()

  reader := pb.Add(prompt, desc.Digest.String(), desc.Size, content)

Fixes #491

[gemini-code-assist]

Code Review

This pull request addresses a resource leak in pkg/backend/push.go by ensuring that blob content is properly closed using a defer statement. Feedback was provided to simplify the accompanying comment for better readability and to move historical context to the commit message.

[SAY-5]

Simplified the close comment per review feedback.

[aftersnow]

Verified against current main: pushIfNotExist never closes the ReadCloser from PullBlob, so every non-manifest blob leaks a file handle on push.

Checked that closing is actually the right call here. fileReader.Close() in distribution v3.1.0 goes through closeWithErr, which does fr.rc.Close() to release the reader chain and only then returns the fileReader: closed sentinel. So the handle is genuinely released, and ignoring the returned error is correct rather than sloppy. The guard on fr.err also makes a second Close a no-op, so there is no double-close risk alongside the existing io.NopCloser wrapper, which stays necessary to keep that sentinel out of Blobs().Push.

Test-merged onto main (9f887eb), built and ran ./pkg/backend/... ./pkg/storage/.... Failure set is identical to the baseline on clean main (all from a local sandbox blocking ~/.docker/config.json), so no regressions.