fix(ci): retry buildx setup against transient Docker Hub timeouts

The 'Set up Docker Buildx' step boots BuildKit, which pulls
moby/buildkit from registry-1.docker.io. A transient Docker Hub
timeout there had no retry (only the build step did), so the whole
build job failed at setup.

Pre-pull the BuildKit image with a 7x/20s retry before the buildx
setup, and pin the action to that exact tag via driver-opts. Once the
image is local, buildx falls back to it if the bootstrap pull fails
('pulling failed, using local image'), so a flaky Docker Hub no longer
breaks setup. Applied to both images-build-ci.yml and
release-version.yml.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/images-build-ci.yml

@@ -82,8 +82,17 @@ jobs:
         shell: bash
         run: bash scripts/github/runner/disk_pressure_report.sh START
 
+      - name: Pre-pull buildkit image (retry 7x, 20s)
+        shell: bash
+        env:
+          MAX_ATTEMPTS: "7"
+          RETRY_DELAY_SECONDS: "20"
+        run: bash scripts/github/runner/pull_with_retry.sh moby/buildkit:buildx-stable-1
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        with:
+          driver-opts: image=moby/buildkit:buildx-stable-1
 
       - name: Login to GHCR
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0

.github/workflows/release-version.yml

@@ -138,8 +138,17 @@ jobs:
           ref: ${{ github.sha }}
           persist-credentials: false
 
+      - name: Pre-pull buildkit image (retry 7x, 20s)
+        shell: bash
+        env:
+          MAX_ATTEMPTS: "7"
+          RETRY_DELAY_SECONDS: "20"
+        run: bash scripts/github/runner/pull_with_retry.sh moby/buildkit:buildx-stable-1
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        with:
+          driver-opts: image=moby/buildkit:buildx-stable-1
 
       - name: Login to GHCR
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0

scripts/github/runner/pull_with_retry.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+image="${1:?Usage: pull_with_retry.sh <image>}"
+max_attempts="${MAX_ATTEMPTS:-7}"
+retry_delay_seconds="${RETRY_DELAY_SECONDS:-20}"
+attempt=1
+
+while true; do
+	echo "=== docker pull ${image} attempt ${attempt}/${max_attempts} ==="
+	if docker pull "${image}"; then
+		echo "Pulled ${image} on attempt ${attempt}/${max_attempts}."
+		break
+	fi
+
+	if [[ "${attempt}" -ge "${max_attempts}" ]]; then
+		echo "Failed to pull ${image} after ${max_attempts} attempts." >&2
+		exit 1
+	fi
+
+	echo "Attempt ${attempt} failed. Retrying in ${retry_delay_seconds}s..."
+	sleep "${retry_delay_seconds}"
+	attempt=$((attempt + 1))
+done