Wait out a registry held still, for up to five minutes, instead of failing the build (issue 457)

The store's nightly collection stops the registry for about a minute and a
half; builds in that window failed on connection refused and failed their
whole plans. A refusal is now waited for with a growing pause, said in the
build's log, and still fails the build past the bound.

internal/builder/registry.go

@@ -52,7 +52,11 @@ func (r Registry) PublishImage(ctx context.Context, localTag, repository string)
 	if _, err := r.Run(ctx, "", "docker", "tag", localTag, remote); err != nil {
 		return "", err
 	}
-	if _, err := r.Run(ctx, "", "docker", "push", remote); err != nil {
+	// The push waits for a registry held still, as every request to it does (novox/hq issue 457).
+	if err := waitForRegistry(ctx, r.Address, "docker push "+remote, func() error {
+		_, err := r.Run(ctx, "", "docker", "push", remote)
+		return err
+	}); err != nil {
 		return "", err
 	}
 	out, err := r.Run(ctx, "", "docker", "inspect", "--format", "{{index .RepoDigests 0}}", remote)
@@ -169,11 +173,13 @@ func (r Registry) has(ctx context.Context, url string, accept ...string) (bool,
 	return response.StatusCode == http.StatusOK, nil
 }
 
+// client is the client for the registry and for upstream, whose requests to the registry wait out a
+// registry held still (novox/hq issue 457).
 func (r Registry) client() *http.Client {
 	if r.HTTP != nil {
-		return r.HTTP
+		return waiting(r.HTTP, r.Address)
 	}
-	return http.DefaultClient
+	return waiting(http.DefaultClient, r.Address)
 }
 
 // separator is whether the upload location already carries a query.