fix(build-container-bake): retry the Syft download once (#374)

Addresses the first half of #373.

## Why

`anchore/sbom-action` downloads Syft at run time. That download failed
twice in one evening on `netresearch/typo3-demo`:

| time (UTC) | run |
|---|---|
| 17:27 |
[31622180041](https://github.com/netresearch/typo3-demo/actions/runs/31622180041)
|
| 19:32 |
[31633121104](https://github.com/netresearch/typo3-demo/actions/runs/31633121104)
|

Both recovered on a plain re-run with no repository change, and other
builds of nearly the same image passed in between — so it is the
download, not the image.

Each failure cost a deployment. The SBOM job failing skips `validate`,
and the consuming repo's Deploy workflow triggers on `workflow_run` of
Build with `conclusion == 'success'`. Both times the container itself
had already built successfully; only the inventory of it was missing.

The same evening produced two more installer failures in unrelated jobs
on that repo (Opengrep, betterleaks — both at their install step, both
green on re-run), which is why #373 reads this as GitHub release
downloads being unreliable rather than anything specific to this
workflow.

## What this changes

The first attempt gets `continue-on-error: true` and an `id`; a second,
identical step runs only `if: steps.syft.outcome == 'failure'`.

Chosen over a retry action because there is nothing new to pin and
audit, and because the second attempt appears as its own step in the run
rather than disappearing into a wrapper's output.

| case | behaviour |
|---|---|
| first attempt succeeds | second is skipped |
| first fails, second succeeds | job continues, SBOM present |
| both fail | **job fails** — the second step has no `continue-on-error`
|

## What this does not change

Whether a missing SBOM should be allowed to stop a release. That is the
second option in #373 and a supply-chain policy question, not mine to
decide — the coupling stays exactly as it is.

## Verification

Structural: the step order and the `if` guard are as listed above, and
the file parses. I have not induced a Syft download failure to watch the
retry fire; the behaviour rests on the documented semantics of
`continue-on-error` and `steps.<id>.outcome`, which distinguish outcome
from conclusion precisely for this pattern.

Author: CybotTM

.github/workflows/build-container-bake.yml

@@ -766,7 +766,19 @@ jobs:
             --output-file="${RUNNER_TEMP}/sbom/sbom-app.cdx.json")
           echo "present=true" >> "$GITHUB_OUTPUT"
 
+      # Two attempts, because the action downloads Syft at run time and that
+      # download is not reliable. It failed twice in one evening on
+      # netresearch/typo3-demo, and each failure cost a deployment: this job
+      # failing skips `validate`, and Deploy triggers on the Build workflow
+      # concluding success. The container itself had built fine both times —
+      # only the inventory of it was missing.
+      #
+      # continue-on-error plus a guarded repeat rather than a retry action: no
+      # new dependency to pin and audit, and the second attempt is visible as
+      # its own step in the run.
       - name: Generate scanned image SBOM (Syft)
+        id: syft
+        continue-on-error: true
         uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
         env:
           # No file cataloguing. Syft's default emits one component per file
@@ -787,6 +799,32 @@ jobs:
           output-file: ${{ runner.temp }}/sbom/sbom-image.cdx.json
           upload-artifact: false
 
+      - name: Wait before the second Syft attempt
+        if: steps.syft.outcome == 'failure'
+        # The failure being retried is an HTTP 503 from github.com, which
+        # routinely lasts longer than the seconds a bare repeat would wait —
+        # both attempts would then land inside the same blip and the deployment
+        # is lost anyway. cosign_retry further down uses 15/30/45s for the same
+        # reason; one wait is enough here because a second failure is rare
+        # enough to be worth a human look.
+        run: sleep 30
+
+      - name: Generate scanned image SBOM (Syft, second attempt)
+        if: steps.syft.outcome == 'failure'
+        # Keep env and with identical to the first attempt. Dropping
+        # SYFT_FILE_METADATA_SELECTION here would produce the per-file BOM the
+        # comment above exists to prevent, and only on the rare retry path.
+        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+        env:
+          SYFT_FILE_METADATA_SELECTION: none
+        with:
+          image: ${{ matrix.subject.name }}@${{ matrix.subject.digest }}
+          registry-username: ${{ github.actor }}
+          registry-password: ${{ secrets.GITHUB_TOKEN }}
+          format: cyclonedx-json
+          output-file: ${{ runner.temp }}/sbom/sbom-image.cdx.json
+          upload-artifact: false
+
       - name: Merge SBOMs, set OCI subject, validate (cyclonedx-cli)
         env:
           # cyclonedx-cli publishes no checksum file; sha256 recorded at pin