image-builder: retry docker build once on failure

The -current full build failed on 2026-09-23 after all ten steps had
passed, at layer export, losing a race on the containerd snapshotter's
content lock ("failed to open writer: ref ... locked for 74ms ...
unavailable"). Disk was not the issue this time (73G free). The build
cache pre-prune that works around this only runs under --force, so the
normal gated nightly build had no guard.

Add docker_build() to lib.sh: docker build, retried once. By the time
the export fails every step is cached, so the retry is little more than
a re-export. Used by build-full-image.sh and build-sbo-testbuild.sh,
the two scripts that export ~20-33G images; bootstrap.sh's image is
small and has never hit this.

Self-check covers success, one failure, and two failures with a stub.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 1 insertions, 1 deletions

diff --git a/image-builder/build-sbo-testbuild.sh b/image-builder/build-sbo-testbuild.sh
index 2bb8487..3949c51 100755
--- a/image-builder/build-sbo-testbuild.sh
+++ b/image-builder/build-sbo-testbuild.sh
@@ -126,7 +126,7 @@ DOCKERFILE
     # (see Main), which suppresses `set -e` in this subshell, so a failed build
     # would otherwise push a nonexistent tag and log "Done".
     _log "  Building ${TB_TAG}..."
-    if ! docker build "${BUILD_FLAGS[@]}" -t "${TB_TAG}" "${WORKDIR}"; then
+    if ! docker_build "${BUILD_FLAGS[@]}" -t "${TB_TAG}" "${WORKDIR}"; then
         _warn "  build failed for ${TB_TAG}; not pushing."
         return 1
     fi