ECR rejects OCI 1.1 referrer manifests during recursive copy (`oras copy -r`)

## Summary

Amazon ECR returns `405 Method Not Allowed` when pushing OCI 1.1 referrer manifests (manifests containing `artifactType` and `subject` fields) via `oras copy -r`. The same operation succeeds against Azure ACR, which fully supports OCI 1.1. This appears related to #2306.

## Environment

- **ORAS CLI**: v1.3.0 (Homebrew)
- **ECR region**: us-east-1
- **Source registry**: ghcr.io (GitHub Container Registry)
- **Source image**: `ghcr.io/buoyantio/extension-init:enterprise-2.19.4-fips`

## Description

The source image includes an SPDX SBOM referrer that conforms to the [OCI Image 1.1 specification](https://opencontainers.org/posts/blog/2024-03-13-image-and-distribution-1-1/), using the `artifactType` and `subject` fields introduced in that spec:

```
oras discover ghcr.io/buoyantio/extension-init:enterprise-2.19.4-fips

ghcr.io/buoyantio/extension-init@sha256:979085578a3e094c016ca31f84b1f6ecd9a823863d95fda712e5c589dbebf134
└── application/spdx+json
└── sha256:08c1ef07d76dfb86f9236371b39ee3888639cc7c77a2e4535e304191f77cbd49
```

The referrer manifest includes both OCI 1.1 fields:

```json
{
"schemaVersion": 2,
"mediaType": "...",
"artifactType": "application/spdx+json",
"config": {...},
"layers": [...],
"subject": {
"mediaType": "application/vnd.oci.image.index.v1+json",
"digest": "sha256:979085578a3e094c016ca31f84b1f6ecd9a823863d95fda712e5c589dbebf134",
"size": 518
},
"annotations": {...}
}
```

## Steps to reproduce

1. Create an ECR repository:

```bash
aws ecr create-repository --region us-east-1 \
--repository-name test/buoyantio/extension-init
```

2. Authenticate with ECR:

```bash
aws ecr get-login-password --region us-east-1 | \
docker login --username AWS --password-stdin .dkr.ecr.us-east-1.amazonaws.com
```

3. Attempt a recursive copy:

```bash
oras copy -r \
ghcr.io/buoyantio/extension-init@sha256:979085578a3e094c016ca31f84b1f6ecd9a823863d95fda712e5c589dbebf134 \
.dkr.ecr.us-east-1.amazonaws.com/test/buoyantio/extension-init:enterprise-2.19.4-fips
```

## Expected behavior

The image index and its SPDX SBOM referrer are both pushed to ECR, consistent with [AWS's announced OCI 1.1 support](https://aws.amazon.com/blogs/opensource/diving-into-oci-image-and-distribution-1-1-support-in-amazon-ecr/).

## Actual behavior

The base image layers are pushed successfully, but ECR rejects the referrer manifest with:

```
PUT ".../manifests/sha256:2d0586ea25f4..." → 405 Method Not Allowed

{
"errors": [{
"code": "UNSUPPORTED",
"message": "Invalid parameter at 'ImageManifest' failed to satisfy constraint: 'Invalid JSON syntax'"
}]
}
```

The error suggests ECR's manifest validation is rejecting the OCI 1.1 referrer manifest, despite the manifest being valid JSON and conforming to the spec.

## Comparison with Azure ACR

The identical `oras copy -r` operation completes successfully against Azure ACR, which [announced OCI 1.1 support in 2024](https://techcommunity.microsoft.com/blog/appsonazureblog/announcing-support-of-oci-v1-1-specification-in-azure-container-registry/4177906). Both the image digest and the SPDX SBOM referrer are copied without errors.

## Current workaround

Dropping the `-r` flag copies the image without referrers:

```bash
oras cp \
ghcr.io/buoyantio/extension-init@sha256:979085578a3e094c016ca31f84b1f6ecd9a823863d95fda712e5c589dbebf134 \
.dkr.ecr.us-east-1.amazonaws.com/test/buoyantio/extension-init:enterprise-2.19.4-fips
```

This succeeds but **does not copy the SPDX SBOM referrer**, which breaks supply-chain attestation workflows.

## Related issues

- oras-project/oras#1224 (closed, not planned)
- opencontainers/image-spec#1025 (closed, not planned)
- aws/containers-roadmap#2306 (open)

Start by reproducing the documented `oras copy -r` command from GHCR to ECR and compare it with the successful Azure ACR operation. There are no repository files or tests named; the issue is complete when ECR accepts the OCI 1.1 referrer manifest and copies the SPDX SBOM without the 405 error.

Written by the indexing model from the issue text.