`oci_load` fails with flag `--nolegacy_external_runfiles`

[Aspect recommends setting `--nolegacy_external_runfiles`](https://docs.aspect.build/guides/bazelrc/#performance-options). But this flag makes `oci_load` failing.

```
> bazel run //:ubuntu
WARNING: /home/tgeng/tmp/oci-legayc-runfiles/MODULE.bazel:3:20: The module extension oci defined in @rules_oci//oci:extensions.bzl reported incorrect imports of repositories via use_repo():

Not imported, but reported as direct dependencies by the extension (may cause the build to fail):
ubuntu_linux_amd64

Fix the use_repo calls by running 'bazel mod tidy'.
INFO: Analyzed target //:ubuntu (39 packages loaded, 178 targets configured).
INFO: Found 1 target...
Target //:ubuntu up-to-date:
bazel-bin/ubuntu.sh
INFO: Elapsed time: 0.343s, Critical Path: 0.00s
INFO: 1 process: 1 internal.
INFO: Build completed successfully, 1 total action
INFO: Running command line: bazel-bin/ubuntu.sh
tar: Error reading archive -: Can't open external/rules_oci~~oci~ubuntu_linux_amd64/layout/blobs/sha256/9df6d6105df2788299e5cbbf3dfd09aa6b3b5a10b784b214c35a035f76deb4ba
tar: Error exit delayed from previous errors.
open /mnt/docker/tmp/docker-import-3457404222/repositories: no such file or directory
```

See attached zip for a full repro.
[repro.zip](https://github.com/user-attachments/files/17083152/repro.zip)

Start with the attached repro.zip and run `bazel run //:ubuntu` with `--nolegacy_external_runfiles` enabled. Trace how `oci_load` accesses `external/rules_oci~~oci~ubuntu_linux_amd64/layout` during the generated `ubuntu.sh` run. Done means the image loads successfully without the tar archive or missing `repositories` errors.

Written by the indexing model from the issue text.