fix: push-first strategy in build_image to avoid losing latest tag

The push_image function deleted the existing manifest before pushing
(Gitea #31964 workaround). When push failed for other reasons (HTTP
500), the old tag was lost, breaking all CI jobs using that image.

Now tries push first, only deletes+retries on "already exists" error.

Closes DEVX-159

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

tests/unit/test_build_image.py

@@ -217,11 +217,36 @@ class TestPushImage:
             assert push_image(spec, "git.example.com", dry_run=True) is True
             mock_run.assert_not_called()
 
-    def test_delete_before_push_with_creds(self) -> None:
+    def test_no_delete_on_success_with_creds(self) -> None:
+        """Push-first: no delete needed when push succeeds."""
         spec = ImageSpec(name="ci-base", dockerfile="Dockerfile", tags=["latest"])
         mock_result = MagicMock(returncode=0, stderr="", stdout="")
         with (
             patch("devx.tools.build_image.subprocess.run", return_value=mock_result),
+            patch("devx.tools.build_image.delete_remote_manifest") as mock_del,
+        ):
+            assert push_image(spec, "git.example.com", username="user", token="tok") is True
+            mock_del.assert_not_called()
+
+    def test_no_delete_without_creds(self) -> None:
+        spec = ImageSpec(name="ci-base", dockerfile="Dockerfile", tags=["latest"])
+        mock_result = MagicMock(returncode=0, stderr="", stdout="")
+        with (
+            patch("devx.tools.build_image.subprocess.run", return_value=mock_result),
+            patch("devx.tools.build_image.delete_remote_manifest") as mock_del,
+        ):
+            assert push_image(spec, "git.example.com") is True
+            mock_del.assert_not_called()
+
+    def test_delete_and_retry_on_already_exists(self) -> None:
+        """Gitea #31964: push fails with 'already exists', delete + retry."""
+        spec = ImageSpec(name="ci-base", dockerfile="Dockerfile", tags=["latest"])
+        results = [
+            MagicMock(returncode=1, stderr="500 Internal Server Error: already exists", stdout=""),
+            MagicMock(returncode=0, stderr="", stdout=""),
+        ]
+        with (
+            patch("devx.tools.build_image.subprocess.run", side_effect=results),
             patch("devx.tools.build_image.delete_remote_manifest", return_value=True) as mock_del,
         ):
             assert push_image(spec, "git.example.com", username="user", token="tok") is True
@@ -234,16 +259,32 @@ class TestPushImage:
                 dry_run=False,
             )
 
-    def test_no_delete_without_creds(self) -> None:
+    def test_no_delete_on_non_already_exists_failure(self) -> None:
+        """Push fails for other reasons (HTTP 500) — old manifest preserved."""
         spec = ImageSpec(name="ci-base", dockerfile="Dockerfile", tags=["latest"])
-        mock_result = MagicMock(returncode=0, stderr="", stdout="")
+        mock_result = MagicMock(
+            returncode=1, stderr="received unexpected HTTP status: 500 Internal Server Error", stdout=""
+        )
         with (
             patch("devx.tools.build_image.subprocess.run", return_value=mock_result),
             patch("devx.tools.build_image.delete_remote_manifest") as mock_del,
         ):
-            assert push_image(spec, "git.example.com") is True
+            assert push_image(spec, "git.example.com", username="user", token="tok") is False
             mock_del.assert_not_called()
 
+    def test_retry_also_fails(self) -> None:
+        """Gitea #31964 retry also fails — both pushes fail."""
+        spec = ImageSpec(name="ci-base", dockerfile="Dockerfile", tags=["latest"])
+        results = [
+            MagicMock(returncode=1, stderr="500 Internal Server Error: already exists", stdout=""),
+            MagicMock(returncode=1, stderr="push failed again", stdout=""),
+        ]
+        with (
+            patch("devx.tools.build_image.subprocess.run", side_effect=results),
+            patch("devx.tools.build_image.delete_remote_manifest", return_value=True),
+        ):
+            assert push_image(spec, "git.example.com", username="user", token="tok") is False
+
 
 class TestDeleteRemoteManifest:
     def test_dry_run(self) -> None: