test(oci): hold the empty-registry skip of ResolveBuildAuth

The whole-repository mutation run without Docker left one edit standing:
`reg == "" || seen[reg]` read as `&&`. A DEVCONTAINERS_OCI_AUTH entry
with an empty host matches an empty registry, so without the skip the
build's auth config gains a "" entry.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: aledbf

internal/oci/buildauth_test.go

@@ -136,3 +136,15 @@ func TestResolveBuildAuth_IdentityToken(t *testing.T) {
 		t.Errorf("Auth should be empty for a token-only credential, got %q", entry.Auth)
 	}
 }
+
+// An empty registry (an image reference with no registry part resolved) is
+// skipped before any lookup, even when DEVCONTAINERS_OCI_AUTH carries an entry
+// with an empty host that would match it.
+func TestResolveBuildAuthSkipsAnEmptyRegistry(t *testing.T) {
+	env := map[string]string{"DEVCONTAINERS_OCI_AUTH": "|u|p", "DOCKER_CONFIG": isolatedDockerConfig(t)}
+	dir, cleanup, ok, err := ResolveBuildAuth(env, []string{""}, log.Null)
+	defer cleanup()
+	if err != nil || ok || dir != "" {
+		t.Errorf("ResolveBuildAuth(\"\") = (%q, ok=%v, %v), want no auth config", dir, ok, err)
+	}
+}