live-oven OCI registry — pull via /v2/<pkg>