chore(deps): drop github.com/docker/docker for split moby modules

[mxab]

What

Removes github.com/docker/docker as a dependency, completing the move to the split upstream modules: github.com/moby/moby/api (Engine API types) and github.com/moby/moby/client (Engine API client).

Note that github.com/moby/moby/v2 is the daemon module and is deliberately not used here — depending on it from a client would pull in the whole engine.

Why

Both moby modules were already in the graph (moby/moby/api direct, moby/moby/client indirect via testcontainers-go v0.43.0), and the testcontainers bump had already moved the container/network types across. That left a single integration-tagged test file as the last consumer of docker/docker. go mod graph confirmed nothing else in the module graph required it:

github.com/mxab/nacp github.com/docker/docker@v28.5.2+incompatible

Changes

pkg/admissionctrl/notation/notation_test.go is the only source file touched:

• Imports move to moby/moby/client and moby/moby/api/types/registry. The dockerRegistry alias is kept to avoid colliding with notation's own registry import.
• types.ImageBuildOptions, image.RemoveOptions and image.PushOptions become client.ImageBuildOptions / client.ImageRemoveOptions / client.ImagePushOptions — the new client hangs options off the client package, so the api/types and api/types/image imports drop out entirely. Field names are unchanged.
• ImageRemove now returns a struct, so the deferred cleanup iterates res.Items.
• ImageInspectWithRaw was removed upstream; ImageInspect replaces it. Its result embeds image.InspectResponse, so insp.RepoDigests is unchanged.

go mod tidy promotes moby/moby/client to a direct dependency and drops moby/sys/atomicwriter and morikuni/aec, which only served docker/docker. docker/go-connections stays indirect (still required by moby/client and testcontainers-go).

Verification

• go build ./... and go vet -tags integration ./... both clean
• No docker/docker references remain in source, go.mod, or go.sum
• Notation integration tests pass against a live daemon (Docker 29.6.2), exercising the real build/push/inspect round-trip:

--- PASS: TestVerifyImage (5.98s)
    --- PASS: TestVerifyImage/no_password (2.27s)
    --- PASS: TestVerifyImage/with_password (3.71s)

The full go test -tags=integration ./... suite was not run locally; CI covers it. No non-test code changed.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud