Retry the Harbor manifest copy instead of a probe for it

The companion SHA tag step failed on the last build even though the image had
already been pushed and deployed. Harbor's vulnerability policy blocks manifest
reads while Trivy's scan is Running, and `imagetools create` copies the manifest,
so Harbor answered 412 Precondition Failed.

Two faults compounded. The loop gated on `imagetools inspect`, but a probe passing
is no guarantee the copy will be allowed. And `create` sat outside the condition,
so under the default `bash -e` its first failure aborted the step before `exit 0`
or any further attempt: the log shows one waiting line, then the error, with 58 of
60 retries unused.

Retry the real operation instead, inside the condition so a blocked copy is a
reason to wait rather than fatal. The trade-off is that a permanently failing copy
now takes the full ten minutes to report instead of failing fast; the previous
behaviour failed fast but wrongly, on a transient block.

Also records that only the primary tag matters for rollout, since the Flux image
policy matches the timestamp tag, so a failure in this step costs the audit tag
rather than the deployment.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitea/workflows/build.yml

@@ -66,14 +66,23 @@ jobs:
           cache-from: type=registry,ref=${{ env.IMAGE }}:buildcache
           cache-to: type=registry,ref=${{ env.IMAGE }}:buildcache,mode=max
 
+      # The primary tag is already pushed and deployable by the time this runs:
+      # the image policy selects `main-<timestamp>`, so a failure here costs the
+      # SHA audit tag, not the rollout.
       - name: Wait for Harbor policy, then add SHA tag
+        shell: bash
         env:
           PRIMARY: ${{ steps.tags.outputs.primary }}
           QUALIFIED: ${{ steps.tags.outputs.qualified }}
         run: |
+          # Harbor's vulnerability policy blocks manifest reads while Trivy's scan
+          # is still Running, and `imagetools create` copies the manifest. Retry
+          # that copy itself rather than an `inspect` probe: a probe that passes is
+          # no guarantee the copy will, and under the default `bash -e` the first
+          # blocked copy aborted the step before its retries could run.
           for attempt in $(seq 1 60); do
-            if docker buildx imagetools inspect "$PRIMARY" >/dev/null 2>&1; then
-              docker buildx imagetools create --tag "$QUALIFIED" "$PRIMARY"
+            if docker buildx imagetools create --tag "$QUALIFIED" "$PRIMARY"; then
+              echo "tagged $QUALIFIED on attempt $attempt"
               exit 0
             fi
             echo "waiting for Harbor scan/pull policy ($attempt/60)"