fix(deploy): retry registry lookups with a timeout

A single blink of the registry failed render_pinned for the whole file and redded the apply stage. registry_digest now retries 3 times under a 25s timeout with a warning per attempt; empty still means unresolvable and callers report it by name as before.

.gitea/workflows/deploy-lib.sh

@@ -233,13 +233,28 @@ registry_digest() {
   # pipefail reports the rightmost non-zero stage, so a ref the registry does not
   # have would abort the caller at the assignment instead of yielding an empty
   # string. The callers check for empty themselves and report it by name.
-  docker manifest inspect "$1" 2>/dev/null \
-    | jq -r --arg arch "$arch" '
-        .manifests[]?
-        | select(.platform.os == "linux" and .platform.architecture == $arch)
-        | .digest
-      ' 2>/dev/null \
-    | head -1 || true
+  #
+  # Retried with a hard timeout because the registry has a known hang mode (and
+  # a known blink mode: a single failed lookup aborts the whole apply file in
+  # render_pinned). A short sleep between attempts lets a restarting registry
+  # come back instead of failing the deploy on one bad second.
+  local attempt=0 digest=""
+  while [ "$attempt" -lt 3 ]; do
+    digest="$(timeout 25s docker manifest inspect "$1" 2>/dev/null \
+      | jq -r --arg arch "$arch" '
+          .manifests[]?
+          | select(.platform.os == "linux" and .platform.architecture == $arch)
+          | .digest
+        ' 2>/dev/null \
+      | head -1 || true)"
+    [ -n "$digest" ] && break
+    attempt=$((attempt + 1))
+    if [ "$attempt" -lt 3 ]; then
+      echo "WARNING: registry lookup of $1 failed (attempt $attempt/3), retrying in 5s" >&2
+      sleep 5
+    fi
+  done
+  printf '%s' "$digest"
 }
 
 # The commit this deploy is for: what CI validated, or - on a manual dispatch,