Report the real layer-extraction failure instead of the downstream crane error

[BinSquare]

When an in-guest image pull fails while extracting a layer, the error was reported as "crane blob failed for layer ". That is misleading: a failed extraction closes the crane -> gunzip -> extract pipe, so gunzip and crane get SIGPIPE and exit non-zero as a downstream symptom. The pull checked crane's status first and surfaced it, hiding the actual cause. This surfaces the extraction error first (including its io error kind, e.g. StorageFull) and keeps crane's stderr as network context, so a pull that fails on a full disk, a truncated stream, or a permission fault reports why instead of pointing at crane. Surfaced a real bug: pulling public-registry images in a Linux guest fails extracting the first sizable layer file with StorageFull — now visible instead of masked.

---

[stage-review]

Ready to review this PR? Stage has broken it down into 2 individual chapters for you:

	Title
1	Include error kind in layer extraction errors
2	Prioritize extraction errors over downstream process failures

_{Chapters generated by Stage for commit 4676e40 on Jul 3, 2026 9:09am UTC.}