OCI package operations can read inconsistent content when a tag changes mid-operation

[AustinAbro321]

Environment

App version: 0.84.0

Title

OCI package operations can read inconsistent content when a tag changes

Description

Zarf may resolve a tagged OCI reference multiple times during one operation. If the tag moves, Zarf can select layers from one manifest but pull from
another, resulting in misleading failures such as:

INF finished pulling package layers
ERR open /tmp/.../zarf.yaml: no such file or directory

This can affect package pulls, inspection, copies, and remote component imports.

Expected behavior

Once Zarf resolves a tagged package reference, all reads within that operation should use the resolved digest. New operations may observe the updated tag.

Steps to reproduce

Hard to reproduce because it's hard to time, but the generally idea is as follows

1. Publish package A under a tag.
2. Start a Zarf pull using that tag.
3. Move the tag to package B before the operation completes.
4. Observe missing or inconsistent package content.

Expected result

Pakcage pull fetches package A.

Actual Result

Missing package content

Visual Proof (screenshots, videos, text, etc)

2026-08-25 07:19:22 ERR open /tmp/zarf-3502237568/zarf-3872210573/zarf.yaml: no such file or directory
--- FAIL: TestECRPublishing (5.78s)
    ecr_publish_test.go:30: E2E: Testing component actions
    ecr_publish_test.go:64: 
        	Error Trace:	/home/runner/work/zarf/zarf/src/test/nightly/ecr_publish_test.go:64
        	Error:      	Received unexpected error:
        	            	exit status 1
        	Test:       	TestECRPublishing
        	Messages:   	%!(EXTRA string=2026-08-25 07:19:21 INF using config file location=/home/runner/work/zarf/zarf/zarf-config.toml
        	            	2026-08-25 07:19:22 INF pulling package name=public.ecr.aws/k2w9d2q6/zarf-nightly/helm-charts:0.0.1 size=29.17 MBs
        	            	2026-08-25 07:19:22 INF finished pulling package layers duration=300ms
        	            	2026-08-25 07:19:22 ERR open /tmp/zarf-3502237568/zarf-3872210573/zarf.yaml: no such file or directory

https://github.com/zarf-dev/zarf/actions/runs/32820736120/job/97718059336

Severity/Priority

low/medium

Additional Context

The cleanest implementation here will require changes in https://github.com/defenseunicorns/pkg/tree/main/oci, we've discussed moving this back to Zarf already.