fix: serialize registry uploads and retry on HTTP 500

Set DOCKER_MAX_CONCURRENT_UPLOADS=1 in build-images workflow to avoid
the Gitea registry BlobUploader.Append race condition. Add tenacity-based
retry (3 attempts, exponential backoff) for HTTP 500 errors in push_image.

# Implements: REQ-1, REQ-2

.gitea/workflows/build-images.yml

@@ -77,6 +77,9 @@ jobs:
           CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
           CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
           PYTHONPATH: src
+          # Serialize blob uploads to avoid Gitea registry race condition
+          # (BlobUploader.Append offset mismatch — see DEVX-162).
+          DOCKER_MAX_CONCURRENT_UPLOADS: "1"
         run: |
           . .venv/bin/activate
           export PATH="$HOME/.local/bin:$PATH"