fix(cd): tolerate bounded workload rollout races

.gitea/workflows/cd.yaml

@@ -3949,22 +3949,26 @@ jobs:
           read_workload_db_identity() {
             workload="$1"
             retry_backoff_seconds="${AWOOOI_DB_IDENTITY_RETRY_BACKOFF_SECONDS:-5}"
+            retry_attempts="${AWOOOI_DB_IDENTITY_RETRY_ATTEMPTS:-6}"
             case "$retry_backoff_seconds" in
               ''|*[!0-9]*) retry_backoff_seconds=5 ;;
             esac
+            case "$retry_attempts" in
+              ''|*[!0-9]*|0) retry_attempts=6 ;;
+            esac
             attempt=1
-            while [ "$attempt" -le 3 ]; do
+            while [ "$attempt" -le "$retry_attempts" ]; do
               if identity_output=$(read_workload_db_identity_once "$@"); then
                 printf '%s\n' "$identity_output"
                 return 0
               fi
-              echo "workload_db_identity_exec_retry=$attempt/3;workload=$workload" >&2
-              if [ "$attempt" -lt 3 ]; then
+              echo "workload_db_identity_exec_retry=$attempt/$retry_attempts;workload=$workload" >&2
+              if [ "$attempt" -lt "$retry_attempts" ]; then
                 sleep "$retry_backoff_seconds"
               fi
               attempt=$((attempt + 1))
             done
-            echo "workload_db_identity_exec_exhausted=3;workload=$workload" >&2
+            echo "workload_db_identity_exec_exhausted=$retry_attempts;workload=$workload" >&2
             printf '%s\n' '{"role_fingerprint":"","connection_limit":null,"required_connection_budget":null,"active_role_connection_count":null,"available_connection_headroom":null,"representative_connection_probe_count":0,"representative_preflight_passed":false,"table_privilege_gap_count":null,"sequence_privilege_gap_count":null,"error_type":"WorkloadDbIdentityAttemptsExhausted"}'
             return 1
           }