fix(cd): retry web node base image pull

.gitea/workflows/cd.yaml

@@ -1625,10 +1625,44 @@ jobs:
 
           # 2026-07-03 Codex: run #4610 proved the Harbor DockerHub proxy
           # cache path returned 401 for node:20-alpine. Keep the public tag
-          # until proxy-cache pull auth has a deploy-log receipt.
+          # until proxy-cache pull auth has a deploy-log receipt. Pull it with
+          # bounded retries and retag locally so transient DockerHub HEAD 500s
+          # do not block source-only UI/CD releases after one failed attempt.
+          prepare_web_node_base_image() {
+            local local_tag="awoooi-web-node-base:20-alpine"
+            local source_image="node:20-alpine"
+            local attempt
+            local pull_rc
+            for attempt in 1 2 3; do
+              echo "web_node_base_pull_candidate=${source_image} attempt=${attempt}"
+              set +e
+              if command -v timeout >/dev/null 2>&1; then
+                timeout -k 10s 120s docker pull "${source_image}"
+              else
+                docker pull "${source_image}"
+              fi
+              pull_rc=$?
+              set -e
+              echo "web_node_base_pull_rc=${source_image}:${pull_rc}"
+              if [ "${pull_rc}" -eq 0 ]; then
+                docker tag "${source_image}" "${local_tag}"
+                WEB_NODE_BASE_IMAGE="${local_tag}"
+                export WEB_NODE_BASE_IMAGE
+                echo "web_node_base_image_selected=${WEB_NODE_BASE_IMAGE}"
+                return 0
+              fi
+              sleep 5
+            done
+            echo "BLOCKER web_node_base_image_pull_failed"
+            echo "NEXT_ACTION inspect_dockerhub_route_or_harbor_proxy_auth_then_rerun_cd"
+            return 1
+          }
+
+          prepare_web_node_base_image
+
           run_docker_step web_build "${DOCKER_WEB_BUILD_TIMEOUT_SECONDS:-1500}" \
             docker build -f apps/web/Dockerfile \
-            --build-arg NODE_BASE_IMAGE=node:20-alpine \
+            --build-arg NODE_BASE_IMAGE="${WEB_NODE_BASE_IMAGE}" \
             --build-arg NEXT_PUBLIC_API_URL=https://awoooi.wooo.work \
             --build-arg CACHE_BUST=${{ github.sha }} \
             --build-arg BUILDKIT_INLINE_CACHE=1 \