ci: retry the distro-image pull instead of failing the job on a Hub hiccup

`docker run` pulls implicitly, so a registry timeout ("context deadline
exceeded" reaching registry-1.docker.io) killed the whole matrix leg with exit
125 before a single test ran, and cost a manual re-run. Seven images per matrix
run makes that a recurring tax rather than a one-off.

Pull up front with backoff (10/20/30s) and only then run the suites.

ONLY the pull is retried. Wrapping `docker run` would re-run the suites on
failure too, which would quietly turn a flaky TEST green -- the opposite of
what this job is for.

Left test-system-utils.yml alone: it uses a job-level `container:`, which the
runner pulls itself, so there is nothing to wrap.

Verified against the step text extracted from the YAML, under `bash -e` (the
shell GitHub actually uses for `run:`): registry down -> 3 retry warnings then
one error annotation and exit 1; flaky -> recovers and exits 0; healthy ->
exits 0 immediately with no retry noise.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.github/workflows/scripts-ci.yml

@@ -110,6 +110,28 @@ jobs:
           - 'opensuse/leap:15.5'
     steps:
       - uses: actions/checkout@v4
+
+      - name: Pull ${{ matrix.image }} (retried — Docker Hub is flaky)
+        run: |
+          # `docker run` pulls implicitly, so a registry hiccup ("context
+          # deadline exceeded" reaching registry-1.docker.io) failed the whole
+          # job with exit 125 and cost a manual re-run. Seven images per matrix
+          # run makes that a recurring tax, so pull up front and retry.
+          #
+          # ONLY the pull is retried. Wrapping `docker run` would re-run the
+          # suites on failure too, quietly turning a flaky TEST green.
+          for attempt in 1 2 3 4; do
+            if docker pull --quiet "${{ matrix.image }}"; then
+              exit 0
+            fi
+            if [ "$attempt" -lt 4 ]; then
+              echo "::warning::pull of ${{ matrix.image }} failed (attempt $attempt/4) — retrying"
+              sleep $((attempt * 10))
+            fi
+          done
+          echo "::error::could not pull ${{ matrix.image }} after 4 attempts — Docker Hub unreachable"
+          exit 1
+
       - name: bash -n + unit suites on ${{ matrix.image }}
         run: |
           docker run --rm -v "$PWD:/src" -w /src "${{ matrix.image }}" sh -c '