The idea we've discussed is that OmicronZoneConfig would grow an artifact_id (or artifact_sha256?) field that identifies which artifact from the [TUF] Repo Depot should be used for this zone's root filesystem.

This is a little trickier than just migrating sled-agent-owned config to Nexus-owned config because the behavior is changing, too:

• if the property is not specified, then the image to be used is "whatever was put in the install dataset by the last mupdate"
• once the property is specified, then the image to be used is what's specified in the property

This likely depends on #4411. If we don't do that first: sled agent has no way to find the right control-plane artifact that contains the requested zone image. (We could have the API identify the control plane artifact instead of the specific image within it. But I think that's not what we want in the long term because it requires Sled Agent to know more about the structure of the TUF repo and it also requires the whole artifact to be present everywhere -- though that second part is already going to be true.)