fix(registry): keep release tags after changelog formatting

[JSONbored]

Summary

• keep release image tags when the only post-release commit formats the generated changelog
• retry Docker Hub tag verification when the API initially returns 404 for a newly pushed tag

What changed

• allows release-tag publishing from a release-format follow-up commit while rejecting arbitrary later commits
• increases Docker Hub tag verification retries and treats 404 as eventually consistent during the retry window
• adds regression coverage for release-format follow-up tags, arbitrary post-release commits, and transient Docker Hub 404s

Why

The mem0 publish pushed images successfully, but immediate Docker Hub verification raced tag propagation and failed. The later changelog-format commits also meant release package tags like v2.0.1-aio.2 and 1.14.0-aio.3 were omitted from image publication.

Validation

• uv run --with pytest pytest tests/test_registry.py
• uv run --with pytest pytest tests/test_registry.py tests/test_control_plane.py
• uv run --with pytest pytest
• trunk check --show-existing --all --no-progress --color=false

Notes

After this lands, rerun the app publish jobs so the missing release package tags are rebuilt and verified.