fix(ci): keep the backfill floor on the path the architecture gate takes

The main merge joined two correct rules into one broken script. The
architecture gate republishes the highest version when :latest misses an
architecture, because the published install instructions pull the image
untagged and only a release of that version rewrites latest. The backfill
floor refuses any tag below v9.0.2, which cannot build from its own tree.

The gate returned before the floor was ever consulted, so an incomplete
:latest would have asked the backfill for a tag it cannot build. Both
paths now ask below_floor, which also replaces the comparison the loop
carried inline.

The picker's own test could not have caught it: its docker stub answers
tags without emitting a manifest, and architectures.sh reads an empty
manifest as every architecture missing, so the gate fired on every case
and printed the newest tag. The stub now serves the whole pool, which is
the state the floor cases assume anyway.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/unit/python/scripts/meta/resolve/missing/test_highest_release_tag.py

@@ -17,6 +17,8 @@ STUBS = {
     "docker": (
         "#!/usr/bin/env bash\n"
         'case " ${STUB_MISSING} " in *" ${3##*:} "*) exit 1 ;; esac\n'
+        'printf \'{"manifests":[{"platform":{"architecture":"amd64"}},'
+        '{"platform":{"architecture":"arm64"}}]}\\n\'\n'
     ),
 }
 
@@ -24,6 +26,10 @@ STUBS = {
 def pick(*missing: str) -> subprocess.CompletedProcess:
     """Run the picker against stubbed ``git`` tags and ``docker`` manifests.
 
+    A present tag answers with a manifest index serving the whole architecture
+    pool, because ``architectures.sh`` parses that index and reads an empty
+    answer as every architecture missing.
+
     Args:
         missing: tags whose images the registry does not hold.
     """