fix: wait for published tag digests to settle

[ianpittwood]

Summary

• pin publish copies to the resolved Stage 1 digest
• copy stale tags before a bounded target-level settling window
• log fallback copy operations

Testing

• uv run ruff format --check posit_bakery/plugins/builtin/imagetools/imagetools.py posit_bakery/plugins/builtin/imagetools/oras.py test/cli/test_ci_publish.py test/plugins/builtin/imagetools/test_oras.py test/plugins/builtin/imagetools/test_publish_stage1.py
• uv run ruff check posit_bakery/plugins/builtin/imagetools/imagetools.py posit_bakery/plugins/builtin/imagetools/oras.py test/cli/test_ci_publish.py test/plugins/builtin/imagetools/test_oras.py test/plugins/builtin/imagetools/test_publish_stage1.py
• uv run pytest test/cli/test_ci_publish.py test/plugins/builtin/imagetools/test_oras.py test/plugins/builtin/imagetools/test_publish_stage1.py -q

[github-actions]

Test Results

2 281 tests  +1   2 281 ✅ +1   7m 45s ⏱️ -22s
    1 suites ±0       0 💤 ±0 
    1 files   ±0       0 ❌ ±0 

Results for commit 0b0a6e0. ± Comparison against base commit 0d75eae.