fix(deploy): retry registry lookups with a timeout

A single blink of the registry failed render_pinned for the whole file and redded the apply stage. registry_digest now retries 3 times under a 25s timeout with a warning per attempt; empty still means unresolvable and callers report it by name as before.

.gitea/workflows/deploy.yaml

@@ -95,12 +95,12 @@ jobs:
     # The 45 minutes this was last raised to 45 were still not enough, and the
     # job logs for those runs no longer exist, so what actually consumed the
     # budget is not known - the two measurable candidates above account for
-    # ~15 of it. The one unbounded thing left in this stage is
-    # `docker manifest inspect` at deploy-lib.sh:236, which has no timeout
-    # against a registry with a known hang mode. Bound it, and make the stage
-    # announce what it is working on, before spending any of that on a larger
-    # ceiling: a stage that is killed with a diagnosable last line is a bug
-    # report, one that vanishes is not.
+    # ~15 of it. The unbounded `docker manifest inspect` against the registry's
+    # known hang mode is now bounded inside registry_digest (25s timeout, 3
+    # attempts): a dead registry fails each owned image after ~85s instead of
+    # hanging the stage, and a blinking one is retried instead of failing the
+    # whole apply file. Still open: make the stage announce which manifest it
+    # is working on, so a killed run leaves a diagnosable last line.
     timeout-minutes: 45
     steps:
       - name: Checkout repository