fix(supply-chain): retry absence too, so a slow alias is not mistaken for a missing one

digest_of accepted "manifest unknown" on the first attempt. GHCR can report a
just-published alias as unknown for a moment, and taking that at face value
would skip a tag this run did publish — leaving it unsigned while the workflow
went green, which is the failure the retry existed to prevent. Absence is now
retried like any other failure and only accepted when the registry still says so
on the final attempt.

Docs:

- The LM Studio steps recreated services with docker-compose.ollama.yml, a
  development stack a production install does not run. They now use the file
  that started the installation.
- Retention is not external work: its cleanup runs inline in the app process,
  and only data drains hand off to a background job. The endpoints start both,
  which is what the sentence should have said.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015BwsJTEQRzWJaY4BRCkPZt

Author: waleedlatif1

.github/workflows/ci.yml

@@ -673,20 +673,26 @@ jobs:
           # "absent" when the registry actually says the manifest is unknown.
           # Anything else fails the step.
           digest_of() {
-            local ref="$1" attempt raw err
+            local ref="$1" attempt raw err absent=0
             for attempt in 1 2 3; do
               if raw="$(docker buildx imagetools inspect "$ref" --format '{{json .Manifest}}' 2>/tmp/inspect.err)"; then
                 printf '%s' "$raw" | jq -r '.digest // empty'
                 return 0
               fi
               err="$(cat /tmp/inspect.err)"
+              # Absence is retried like any other failure: GHCR can report a
+              # just-published alias as unknown for a moment, and accepting that
+              # on the first attempt would skip a tag this run did publish.
               case "$err" in
-                *"not found"*|*MANIFEST_UNKNOWN*|*"no such manifest"*|*"NAME_UNKNOWN"*)
-                  return 0
-                  ;;
+                *"not found"*|*MANIFEST_UNKNOWN*|*"no such manifest"*|*"NAME_UNKNOWN"*) absent=1 ;;
+                *) absent=0 ;;
               esac
               sleep "$((attempt * 3))"
             done
+            # Only call it absent if the registry said so on the final attempt.
+            if [ "$absent" -eq 1 ]; then
+              return 0
+            fi
             echo "::error::Could not inspect ${ref} after 3 attempts: ${err}" >&2
             return 1
           }

apps/docs/content/docs/platform/enterprise/self-hosted.mdx

@@ -69,7 +69,7 @@ See [Sandboxes](/platform/self-hosting/sandboxes) for the provider credentials,
 
 ## Schedule the background jobs
 
-Two enterprise features do their work from a cron-driven HTTP endpoint rather than from the app process. All four endpoints authenticate with a bearer token equal to `CRON_SECRET`, and all four return `401` when it is unset:
+Two enterprise features are started by a cron-driven HTTP endpoint rather than by the app on its own schedule. What happens next differs: retention's cleanup runs inline in the app process, while each due data drain is handed to a background job. All four endpoints authenticate with a bearer token equal to `CRON_SECRET`, and all four return `401` when it is unset:
 
 ```bash
 openssl rand -hex 32

apps/docs/content/docs/platform/self-hosting/troubleshooting.mdx

@@ -61,9 +61,11 @@ Sim identifies dynamically discovered LM Studio and vLLM models by their `vllm/`
 
 1. Set `VLLM_BASE_URL`, and `VLLM_API_KEY` too if you enabled LM Studio's API authentication — without the key, discovery requests omit the bearer token and fail. No Compose file sets either for you — `docker-compose.ollama.yml` only sets `OLLAMA_URL` — so add them to the `simstudio` service's `environment:` block (or to `.env` and interpolate them), then recreate the service and confirm it landed:
 
+   Use the Compose file that started your installation — `docker-compose.prod.yml` for the documented production setup:
+
    ```bash
-   docker compose -f docker-compose.ollama.yml up -d --force-recreate simstudio
-   docker compose -f docker-compose.ollama.yml exec simstudio printenv VLLM_BASE_URL
+   docker compose -f docker-compose.prod.yml up -d --force-recreate simstudio
+   docker compose -f docker-compose.prod.yml exec simstudio printenv VLLM_BASE_URL
    ```
 
    An empty result means the variable never reached the container, and model discovery cannot run.