fix(ci): retry transient tested-image reads without relaxing admission

[proerror77]

Problem and change

A transient GitHub HTTP 502 interrupted tested-image retrieval in Release run 38771978894. The original log does not identify which read failed. A later source was published successfully in run 38775108770; this PR does not rerun publication.

Retry the five GitHub read/download boundaries at most three times for HTTP 500/502/503/504, with stage diagnostics and isolated partial responses/downloads. Preserve exact-source producer authentication, job/attempt checks, artifact hash and loaded-image verification. Authentication errors and invalid evidence fail immediately. Exhausted transport errors cannot return the authenticated-absence status that permits an explicit fallback build.

Validation

• Tested-image tests cover each boundary recovering on attempt three, permanent transient failures, 401/403/404, partial bytes, and existing admission/fallback checks.
• Main image scope regression tests passed.
• ACR publication contract tests: 24 runs, 92 assertions, zero failures.
• Shell syntax, ShellCheck, and git diff --check passed.
• Scoped CI dry run selects contract/lint/hygiene and security checks; no research product or image build selected.

No publishing rerun, deployment, cloud resource, or permissions change.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}