ci(publish): increase GHCR visibility check from 120s to 360s

GHCR can take >120s to expose a newly-pushed image tag. The 12×10s
visibility check caused all 4 publish-image jobs to fail on 2026-07-28
even though podman push completed successfully (images were accessible
minutes later via skopeo inspect).

Increase to 36×10s (6 minutes) for both post-push and pre-stream-tag
visibility loops to absorb observed GHCR propagation delays.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: castrojo

.github/workflows/publish.yml

@@ -217,17 +217,18 @@ jobs:
 
           # GHCR can briefly return manifest unknown immediately after a push.
           # Do not let downstream smoke/release workflows race that visibility lag.
-          for attempt in $(seq 1 12); do
+          # 36 × 10 s = 6 min — observed GHCR lag can exceed 120 s on large pushes.
+          for attempt in $(seq 1 36); do
             if skopeo inspect --no-tags \
                 "docker://${IMAGE}:${BUILD_SHA}" > /dev/null 2>&1; then
               echo "Verified immutable tag :${BUILD_SHA} is readable (attempt ${attempt})"
               break
             fi
-            if [ "$attempt" -eq 12 ]; then
+            if [ "$attempt" -eq 36 ]; then
               echo "ERROR: GHCR never exposed :${BUILD_SHA} after push"
               exit 1
             fi
-            echo "Waiting for GHCR to expose :${BUILD_SHA} (attempt ${attempt}/12)..."
+            echo "Waiting for GHCR to expose :${BUILD_SHA} (attempt ${attempt}/36)..."
             sleep 10
           done
 
@@ -420,16 +421,17 @@ jobs:
           IMAGE="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}${{ matrix.image_suffix }}"
           # Check the immutable source before copying. This also absorbs a short
           # GHCR manifest-visibility delay without moving a broken stream tag.
-          for attempt in $(seq 1 12); do
+          # 36 × 10 s = 6 min — observed GHCR lag can exceed 120 s on large pushes.
+          for attempt in $(seq 1 36); do
             if skopeo inspect --no-tags \
                 "docker://${IMAGE}:${BUILD_SHA}" > /dev/null 2>&1; then
               break
             fi
-            if [ "$attempt" -eq 12 ]; then
+            if [ "$attempt" -eq 36 ]; then
               echo "ERROR: source tag :${BUILD_SHA} is not readable in GHCR"
               exit 1
             fi
-            echo "Waiting for source tag :${BUILD_SHA} (attempt ${attempt}/12)..."
+            echo "Waiting for source tag :${BUILD_SHA} (attempt ${attempt}/36)..."
             sleep 10
           done