Part 1: The Two Ways Margo Ships an App

A single Margo application can ship the same service two ways — as a Helm chart and as a Compose Archive — and the spec publishes those two ways through two different worlds. One is content-addressed and OCI-native; the other is a tarball at a plain URL whose signing key is fetched over that same unauthenticated channel. That asymmetry is the last-mile gap this series closes.