[patch] Limit retry hints to pre-dispatch failures

[libops-agent]

Summary\n\n- classify exhausted pre-connect backend dials as safely retryable\n- emit Retry-After only when a request was not dispatched\n- omit retry hints after permanent power failures and ambiguous post-connect failures\n- prove POST bodies are delivered at most once across a post-connect reset\n- make the explicitly dispatched tagged GoReleaser workflow call and await the existing shared GHCR/GAR image workflow\n- keep human/PAT tag pushes on their existing direct image path without duplicate publication\n- keep PPB as a thin caller of the pinned libops/.github publisher; GHCR is universal and GAR is added because PPB runs on Cloud Run\n\n## Validation\n\n- go test -race ./...\n- gofmt -d\n- actionlint\n- git diff --check\n\n## Release gate\n\nDepends on libops/api#44. Merge that Terraform correction, run one full non-targeted iac/libops-images apply during a publication-free window, then dispatch this branch build workflow from a trusted ref and verify successful pushes to both GHCR and GAR. Only then make this PR ready and merge it. After merge, the 0.5.1 GoReleaser run must remain green through its nested publish-images job, and both registry tags must be verified before cloud-compose is updated.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 78.94737% with 4 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
pkg/proxy/tls.go	75.00%	3 Missing and 1 partial ⚠️

Files with missing lines	Coverage Δ
main.go	51.00% <100.00%> (+1.00%)	⬆️
pkg/proxy/tls.go	83.43% <75.00%> (+7.76%)	⬆️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[libops-agent]

The new PR preflight is intentionally blocking merge: WIF reaches the configured credential chain, but impersonation of the dedicated publisher still fails because the github-public-ppb@libops-images.iam.gserviceaccount.com resources from API iac/libops-images have not been applied.

An authorized operator must apply the full iac/libops-images root (not a targeted apply and not the legacy shared publisher), then rerun the failed check. Once this PR is fully green, it can be merged; the resulting 0.5.1 main/tag publish must also be green before downstream digest pins move.