Based on #5075 (comment)

When having a look at our implementation, I realize that the ADR just says: "We'll download via OCI", but not at all what's meant by this. As far as I understand, there's no common understanding of what it means to download an artifact via OCI, i.e. it is very much implementation dependent.

I think we should augment the ADR with a spec what k0s means/expects when it tries to download files from OCI registries. WDYT?