# DEVX-172: dep-PR retries container verification until publish lands

## Problem

Post-merge dep-PR runs concurrently with the producer's image-build
workflow. `--verify-container` hits HTTP 404 before the push lands and
skips PR creation — observed for sso-bridge v0.4.1 and v0.4.3.

## Approach

REQ-1: `resolve_container_digest(..., timeout_s)` retries a 404 lookup
every 15s until the deadline.
REQ-2: `--verify-timeout` CLI option (default 600s, 0 disables) wires the
retry into the dep-PR step.

## Test Plan

- Unit test: 404-then-200 resolves the digest without raising.
- Existing no-retry path (timeout_s=0) still fails immediately.

## Deploy Plan

devx release tag; producers inherit the 600s default on next pin bump.

## Rollback Plan

Revert; dep-PR verification fails fast on 404 again (status quo).

## Acceptance Criteria

- [x] REQ-1: 404 responses retry until `timeout_s` deadline.
- [x] REQ-2: `--verify-timeout` option exposed, default 600.