fix: close OCI blob reader and wrap errors consistently across controllers

[immanuwell]

3 small fixes:

1. selectLayer() returns io.ReadCloser but the caller never closes it. tar.Untar wraps it in io.NopCloser so the registry connection leaks on every reconcile. Added defer blob.Close().

2. bucket_controller and ocirepository_controller use %s in fmt.Errorf, breaking errors.Is/errors.As. gitrepository_controller already uses %w for the same message -- making the others consistent.

3. Typo: reconcilation -> reconciliation in a user-visible message.

Reproduce the leak: run with many OCIRepository resources on a short interval and watch lsof -p <pid> | grep -c socket climb without dropping between reconciles. Related: #1867.