fix: push-first strategy in build_image to avoid losing latest tag

The push_image function deleted the existing manifest before pushing
(Gitea #31964 workaround). When push failed for other reasons (HTTP
500), the old tag was lost, breaking all CI jobs using that image.

Now tries push first, only deletes+retries on "already exists" error.

Closes DEVX-159

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

docs/specs/DEVX-159.md

@@ -0,0 +1,41 @@
+# DEVX-159: Fix build_image push-first strategy to avoid losing latest tag
+
+## Problem
+The `push_image` function in `build_image.py` deletes the existing
+manifest *before* pushing (Gitea #31964 workaround). When the push
+fails for other reasons (HTTP 500), the old tag is lost, breaking all
+CI jobs that use that image.
+
+This caused `ci-base:latest` to disappear from the registry when
+build-images run #4104 failed with HTTP 500 on push, after already
+deleting the old `latest` manifest.
+
+## Approach
+Switch to a push-first strategy:
+1. Try pushing directly
+2. Only if push fails with "already exists" (Gitea #31964), delete
+   the old manifest and retry
+3. If push fails for any other reason, the old manifest is preserved
+
+REQ-1: Push first, no pre-emptive delete
+REQ-2: Delete + retry only on "already exists" error
+REQ-3: Old manifest preserved on non-already-exists failures
+REQ-4: 100% test coverage of new logic
+
+## Test Plan
+- Unit tests for all push paths (success, already-exists retry,
+  non-already-exists failure, retry-also-fails)
+- Verify existing tests still pass
+
+## Deploy Plan
+- Merge to master, build-images workflow uses new push logic on next
+  image rebuild
+
+## Rollback Plan
+- Revert the merge commit
+
+## Acceptance Criteria
+- [x] REQ-1: Push first, no pre-emptive delete
+- [x] REQ-2: Delete + retry only on "already exists" error
+- [x] REQ-3: Old manifest preserved on non-already-exists failures
+- [x] REQ-4: 100% test coverage of new logic