Add scripts/repack_cuda_runtime.py as the operator CLI for repacking tagged server-cuda13 llama.cpp OCI images into deterministic per-arch tar.gz artifacts with provenance.json, licenses/, and a .sha256 sidecar. Read CUDA_SERVER_PIN as the wanted-file source of truth instead of duplicating the wanted-file lists. Deliberately import oci_image private helpers so OCI blob, layer, whiteout, traversal, and digest semantics remain single-sourced, with zero edits to that module. Gate NVIDIA EULA handling against the CLO-reviewed CUDA 13.3 sha with no override path, and append the matching third-party notice block shipped with the repack pipeline.