Part of #1486. Depends on the centralization issue; can land alongside the flip.

Implement the transition window so old artifacts keep working for one release.

• pkg/header.IsSupportedAPIVersion accepts both aicr.nvidia.com/v1alpha1 and aicr.run/v1alpha1 (and the v1beta1 build spec equivalents)
• Artifact decoders (pkg/build/spec.go, recipe/snapshot/config loaders) accept either group on read
• Emit a single deprecation slog.Warn when the old group is encountered
• Always write the new aicr.run group

Follow the dual-accept pattern documented in docs/design/011-artifact-apiversion-policy.md.

Acceptance criteria

• Old-group artifact reads successfully + logs one deprecation warning
• All writes emit aicr.run
• Table-driven tests cover old, new, and empty apiVersion
• make qualify green