image-builder: catch build/push failures, prune cache on --force

The main loop runs build_variant in an `if ! (...)` condition, which
suppresses set -e inside the subshell, so a failed docker build fell through
to push a nonexistent tag and log "Done" (seen live: a transient containerd
export lock reported success). Add explicit exit checks on docker build and
docker push in all three scripts; return non-zero so the variant is marked
failed.

Also prune the build cache before a --force full-image build: --force already
implies --no-cache, so the stale cache is dead weight that still loads the
snapshotter's lock bookkeeping and has raced the layer export. Best-effort,
never fails the build.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

1 files changed, 11 insertions, 2 deletions

diff --git a/.extras/image-builder/bootstrap.sh b/.extras/image-builder/bootstrap.sh
index e9d9be5..9893e66 100755
--- a/.extras/image-builder/bootstrap.sh
+++ b/.extras/image-builder/bootstrap.sh
@@ -521,9 +521,18 @@ LABEL slackware.arch="x86_64"
 CMD ["/bin/bash"]
 DOCKERFILE
 
+    # Explicit exit checks: build_variant runs in an `if ! (...)` condition
+    # (see Main), which suppresses `set -e` in this subshell, so a failed build
+    # would otherwise push a nonexistent tag and log "Done".
     _log "Building and pushing ${TAG}..."
-    docker build --no-cache -t "${TAG}" "${WORKDIR}"
-    docker push "${TAG}"
+    if ! docker build --no-cache -t "${TAG}" "${WORKDIR}"; then
+        _warn "build failed for ${TAG}; not pushing."
+        return 1
+    fi
+    if ! docker push "${TAG}"; then
+        _warn "push failed for ${TAG}."
+        return 1
+    fi
     _log "=== Done: ${TAG} ==="
 }