#9430 fix(ci): fail the promote wait on a digest lookup error instead of retrying it

Summary

• promote-app-image.sh waited for the moved tag with until [ "$(get-ecr-image-digest.sh …)" = "$DIGEST" ]. A failing command substitution inside a test condition doesn't trip set -e, so a real lookup error (an AWS error, or a malformed response) was retried until the 60s deadline and then reported as "did not resolve … within 60s".
• The lookup now happens in the loop body as an assignment, so a failed lookup stops the script with its own error. A tag that hasn't propagated yet is still retried up to the deadline, and the AWS CLI's own retries still cover transient errors.
• Raised on the release PR #9426.

Type of Change

• Bug fix

Testing

• Ran the script in a Linux container with stubbed docker/aws:
  • stale read that catches up: changed=true
  • unchanged retag: changed=false
  • tag that never resolves: fails at the deadline
  • first push with no previous tag: changed=true
  • lookup error after the push (new case): fails immediately with exit 1. The previous script swallowed it, retried until the deadline and printed the propagation error.
• shellcheck, bash -n

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)