Talos image factory transients fail the deploy's cluster update #5013

🤖 Generated by the Agentic Engineer (interactive Claude Code session)

Evidence

Found by the merge-queue failure count in #4993.

• 6 failed merge-group runs, on 2026-09-20 and 2026-10-12, failed in the deploy job's Talos cluster update because the Talos image factory was unreachable or slow: a TLS handshake timeout or deadline while registering the schematic, or a failed snapshot image download.
• Evidence basis: logs for all 6 runs.
• Examples: 35488969077, 38266777124, 38306469705.

Problem

A slow third-party service evicts a candidate and starts a heal deploy, although nothing in the candidate needed a new image.

Expected behaviour

A transient image-factory error during cluster update is retried within a fixed bound, and only a lasting failure fails the deploy.

Acceptance criteria

• Decide where the retry belongs: the deploy's call into KSail, or KSail itself (file the KSail issue if it is there).
• A transient timeout or download failure is retried with backoff, within a fixed bound; a lasting failure still fails and names the service.
• A test covers one transient failure followed by success.

Size: small. Part of #4979.