Closes #1249.

PR #1244's `aicr recipe sign-catalog` post-hook and PR #1245's
`cli-bundle-attestation-ci` chainsaw test both failed with the same
trace:

  [TIMEOUT] sigstore signing timed out:
    Post "https://rekor.sigstore.dev/api/v1/log/entries":
    giving up after 1 attempt(s): context deadline exceeded

The "1 attempt(s)" came from `pkg/bundler/attestation/signing.go`'s
single-pass `sign.Bundle()` call — the wrapper had no retry, so a
slow Rekor response on the only attempt turned ordinary upstream
latency into a CI failure.

Changes:

- pkg/defaults/timeouts.go:
    SigstoreAttemptTimeout (35s) bounds a single sign.Bundle call.
    SigstoreRetryBudget (3) caps total attempts.
    SigstoreRetryInitialBackoff (1s) + SigstoreRetryBackoffFactor (5)
    produce backoffs of 1s, 5s. Worst-case wall-clock (3 × 35s +
    1s + 5s = 111s) fits inside the existing SigstoreSignTimeout
    (2m) ceiling.

- pkg/defaults/timeouts_test.go:
    TestSigstoreRetryBudgetInvariant guards the math against future
    tuning that would overflow SigstoreSignTimeout.

- pkg/bundler/attestation/signing.go:
    Extracted the sign.Bundle invocation into signWithRetry, a
    bounded exponential-backoff retry helper. Retry semantics:
    - outer ctx DeadlineExceeded → ErrCodeTimeout, no retry.
    - outer ctx Canceled → ErrCodeUnavailable, no retry.
    - per-attempt failure with outer ctx alive → retry until budget
      exhausted, then ErrCodeUnavailable wrapping the last error.
    Backoff sleep is interruptible by the outer ctx — a slow Rekor
    recovering 10s later doesn't waste the remaining budget.

- pkg/bundler/attestation/signing_retry_test.go:
    Five tests: success-on-first, success-after-transient (verifies
    one backoff is honored), budget-exhaustion (counts attempts +
    asserts ErrCodeUnavailable + wrapped sentinel), outer-deadline
    (asserts ErrCodeTimeout + retry short-circuits), outer-cancel
    (asserts ErrCodeUnavailable). Uses real timing; full-exhaustion
    test runs ~6s. All run in parallel.

- .goreleaser.yaml:
    cosign attest-blob now passes --retry 5 (matches cosign's
    documented default backoff). Costs nothing on a healthy Rekor;
    absorbs an entire release run when Rekor is slow.

- pkg/bundler/attestation/doc.go:
    New "Retry Contract" section documents the per-attempt /
    outer-ceiling split, the three retry-class branches, and the
    invariant test pointer.

Refs #1244 (first observed instance), #1245 (second instance, in
review at time of merge).

Closes #1249.

PR #1244's `aicr recipe sign-catalog` post-hook and PR #1245's
`cli-bundle-attestation-ci` chainsaw test both failed with the same
trace:

  [TIMEOUT] sigstore signing timed out:
    Post "https://rekor.sigstore.dev/api/v1/log/entries":
    giving up after 1 attempt(s): context deadline exceeded

The "1 attempt(s)" came from `pkg/bundler/attestation/signing.go`'s
single-pass `sign.Bundle()` call — the wrapper had no retry, so a
slow Rekor response on the only attempt turned ordinary upstream
latency into a CI failure.

Changes:

- pkg/defaults/timeouts.go:
    SigstoreAttemptTimeout (35s) bounds a single sign.Bundle call.
    SigstoreRetryBudget (3) caps total attempts.
    SigstoreRetryInitialBackoff (1s) + SigstoreRetryBackoffFactor (5)
    produce backoffs of 1s, 5s. Worst-case wall-clock (3 × 35s +
    1s + 5s = 111s) fits inside the existing SigstoreSignTimeout
    (2m) ceiling.

- pkg/defaults/timeouts_test.go:
    TestSigstoreRetryBudgetInvariant guards the math against future
    tuning that would overflow SigstoreSignTimeout.

- pkg/bundler/attestation/signing.go:
    Extracted the sign.Bundle invocation into signWithRetry, a
    bounded exponential-backoff retry helper. Retry semantics:
    - outer ctx DeadlineExceeded → ErrCodeTimeout, no retry.
    - outer ctx Canceled → ErrCodeUnavailable, no retry.
    - per-attempt failure with outer ctx alive → retry until budget
      exhausted, then ErrCodeUnavailable wrapping the last error.
    Backoff sleep is interruptible by the outer ctx — a slow Rekor
    recovering 10s later doesn't waste the remaining budget.

- pkg/bundler/attestation/signing_retry_test.go:
    Five tests: success-on-first, success-after-transient (verifies
    one backoff is honored), budget-exhaustion (counts attempts +
    asserts ErrCodeUnavailable + wrapped sentinel), outer-deadline
    (asserts ErrCodeTimeout + retry short-circuits), outer-cancel
    (asserts ErrCodeUnavailable). Uses real timing; full-exhaustion
    test runs ~6s. All run in parallel.

- .goreleaser.yaml:
    cosign attest-blob now passes --retry 5 (matches cosign's
    documented default backoff). Costs nothing on a healthy Rekor;
    absorbs an entire release run when Rekor is slow.

- pkg/bundler/attestation/doc.go:
    New "Retry Contract" section documents the per-attempt /
    outer-ceiling split, the three retry-class branches, and the
    invariant test pointer.

Refs #1244 (first observed instance), #1245 (second instance, in
review at time of merge).

Closes #1249.

PR #1244's `aicr recipe sign-catalog` post-hook and PR #1245's
`cli-bundle-attestation-ci` chainsaw test both failed with the same
trace:

  [TIMEOUT] sigstore signing timed out:
    Post "https://rekor.sigstore.dev/api/v1/log/entries":
    giving up after 1 attempt(s): context deadline exceeded

The "1 attempt(s)" came from `pkg/bundler/attestation/signing.go`'s
single-pass `sign.Bundle()` call — the wrapper had no retry, so a
slow Rekor response on the only attempt turned ordinary upstream
latency into a CI failure.

Changes:

- pkg/defaults/timeouts.go:
    SigstoreAttemptTimeout (35s) bounds a single sign.Bundle call.
    SigstoreRetryBudget (3) caps total attempts.
    SigstoreRetryInitialBackoff (1s) + SigstoreRetryBackoffFactor (5)
    produce backoffs of 1s, 5s. Worst-case wall-clock (3 × 35s +
    1s + 5s = 111s) fits inside the existing SigstoreSignTimeout
    (2m) ceiling.

- pkg/defaults/timeouts_test.go:
    TestSigstoreRetryBudgetInvariant guards the math against future
    tuning that would overflow SigstoreSignTimeout.

- pkg/bundler/attestation/signing.go:
    Extracted the sign.Bundle invocation into signWithRetry, a
    bounded exponential-backoff retry helper. Retry semantics:
    - outer ctx DeadlineExceeded → ErrCodeTimeout, no retry.
    - outer ctx Canceled → ErrCodeUnavailable, no retry.
    - per-attempt failure with outer ctx alive → retry until budget
      exhausted, then ErrCodeUnavailable wrapping the last error.
    Backoff sleep is interruptible by the outer ctx — a slow Rekor
    recovering 10s later doesn't waste the remaining budget.

- pkg/bundler/attestation/signing_retry_test.go:
    Five tests: success-on-first, success-after-transient (verifies
    one backoff is honored), budget-exhaustion (counts attempts +
    asserts ErrCodeUnavailable + wrapped sentinel), outer-deadline
    (asserts ErrCodeTimeout + retry short-circuits), outer-cancel
    (asserts ErrCodeUnavailable). Uses real timing; full-exhaustion
    test runs ~6s. All run in parallel.

- .goreleaser.yaml:
    cosign attest-blob now passes --retry 5 (matches cosign's
    documented default backoff). Costs nothing on a healthy Rekor;
    absorbs an entire release run when Rekor is slow.

- pkg/bundler/attestation/doc.go:
    New "Retry Contract" section documents the per-attempt /
    outer-ceiling split, the three retry-class branches, and the
    invariant test pointer.

Refs #1244 (first observed instance), #1245 (second instance, in
review at time of merge).

Closes #1249.

PR #1244's `aicr recipe sign-catalog` post-hook and PR #1245's
`cli-bundle-attestation-ci` chainsaw test both failed with the same
trace:

  [TIMEOUT] sigstore signing timed out:
    Post "https://rekor.sigstore.dev/api/v1/log/entries":
    giving up after 1 attempt(s): context deadline exceeded

The "1 attempt(s)" came from `pkg/bundler/attestation/signing.go`'s
single-pass `sign.Bundle()` call — the wrapper had no retry, so a
slow Rekor response on the only attempt turned ordinary upstream
latency into a CI failure.

Changes:

- pkg/defaults/timeouts.go:
    SigstoreAttemptTimeout (35s) bounds a single sign.Bundle call.
    SigstoreRetryBudget (3) caps total attempts.
    SigstoreRetryInitialBackoff (1s) + SigstoreRetryBackoffFactor (5)
    produce backoffs of 1s, 5s. Worst-case wall-clock (3 × 35s +
    1s + 5s = 111s) fits inside the existing SigstoreSignTimeout
    (2m) ceiling.

- pkg/defaults/timeouts_test.go:
    TestSigstoreRetryBudgetInvariant guards the math against future
    tuning that would overflow SigstoreSignTimeout.

- pkg/bundler/attestation/signing.go:
    Extracted the sign.Bundle invocation into signWithRetry, a
    bounded exponential-backoff retry helper. Retry semantics:
    - outer ctx DeadlineExceeded → ErrCodeTimeout, no retry.
    - outer ctx Canceled → ErrCodeUnavailable, no retry.
    - per-attempt failure with outer ctx alive → retry until budget
      exhausted, then ErrCodeUnavailable wrapping the last error.
    Backoff sleep is interruptible by the outer ctx — a slow Rekor
    recovering 10s later doesn't waste the remaining budget.

- pkg/bundler/attestation/signing_retry_test.go:
    Five tests: success-on-first, success-after-transient (verifies
    one backoff is honored), budget-exhaustion (counts attempts +
    asserts ErrCodeUnavailable + wrapped sentinel), outer-deadline
    (asserts ErrCodeTimeout + retry short-circuits), outer-cancel
    (asserts ErrCodeUnavailable). Uses real timing; full-exhaustion
    test runs ~6s. All run in parallel.

- .goreleaser.yaml:
    cosign attest-blob now passes --retry 5 (matches cosign's
    documented default backoff). Costs nothing on a healthy Rekor;
    absorbs an entire release run when Rekor is slow.

- pkg/bundler/attestation/doc.go:
    New "Retry Contract" section documents the per-attempt /
    outer-ceiling split, the three retry-class branches, and the
    invariant test pointer.

Refs #1244 (first observed instance), #1245 (second instance, in
review at time of merge).

Deployment-phase health-check validation regressed in the recent
in-process executor + deepened-check stack (NVIDIA#1235/NVIDIA#1245/NVIDIA#1252):

1. inprocess.go: runAssertWithRetry/runErrorWithRetry retried ANY
   non-nil error, so a permanent JMESPath evaluation error was retried
   for the entire assert window (6m) instead of failing fast like the
   old chainsaw binary did. Classify assertion-engine errors as
   ErrCodeInvalidRequest (terminal) and short-circuit the retry loops
   on them. Adds a regression test asserting terminal eval errors
   fail fast (< AssertRetryInterval) rather than retrying to deadline.

2. recipes/checks/*: the (init)containerStatuses[?...] | length(@)
   projection throws 'invalid type for: <nil>' on any pod without
   (init) containers (the common case), feeding defect #1. Coalesce to
   an empty array across all 22 affected component health checks.

3. recipes/checks/dynamo-platform: validate-deployment-exists asserted
   a Deployment named 'dynamo-operator', but the chart prefixes it with
   the release name (dynamo-platform-dynamo-operator-controller-manager),
   so the assert never matched and retried to the deadline. Match by the
   stable app.kubernetes.io/name=dynamo-operator label instead.

Verified on an EKS H100 cluster: deployment phase goes from an 8m
timeout (status=other) to PASSED in ~21s; full deployment 4/4 and
conformance 11/11 green.

Deployment-phase health-check validation regressed in the recent
in-process executor + deepened-check stack (NVIDIA#1235/NVIDIA#1245/NVIDIA#1252):

1. inprocess.go: runAssertWithRetry/runErrorWithRetry retried ANY
   non-nil error, so a permanent JMESPath evaluation error was retried
   for the entire assert window (6m) instead of failing fast like the
   old chainsaw binary did. Classify assertion-engine errors as
   ErrCodeInvalidRequest (terminal) and short-circuit the retry loops
   on them. Adds a regression test asserting terminal eval errors
   fail fast (< AssertRetryInterval) rather than retrying to deadline.

2. recipes/checks/*: the (init)containerStatuses[?...] | length(@)
   projection throws 'invalid type for: <nil>' on any pod without
   (init) containers (the common case), feeding defect #1. Coalesce to
   an empty array across all 22 affected component health checks.

3. recipes/checks/dynamo-platform: validate-deployment-exists asserted
   a Deployment named 'dynamo-operator', but the chart prefixes it with
   the release name (dynamo-platform-dynamo-operator-controller-manager),
   so the assert never matched and retried to the deadline. Match by the
   stable app.kubernetes.io/name=dynamo-operator label instead.

Verified on an EKS H100 cluster: deployment phase goes from an 8m
timeout (status=other) to PASSED in ~21s; full deployment 4/4 and
conformance 11/11 green.

Deployment-phase health-check validation regressed in the recent
in-process executor + deepened-check stack (NVIDIA#1235/NVIDIA#1245/NVIDIA#1252):

1. inprocess.go: runAssertWithRetry/runErrorWithRetry retried ANY
   non-nil error, so a permanent JMESPath evaluation error was retried
   for the entire assert window (6m) instead of failing fast like the
   old chainsaw binary did. Classify assertion-engine errors as
   ErrCodeInvalidRequest (terminal) and short-circuit the retry loops
   on them. Adds a regression test asserting terminal eval errors
   fail fast (< AssertRetryInterval) rather than retrying to deadline.

2. recipes/checks/*: the (init)containerStatuses[?...] | length(@)
   projection throws 'invalid type for: <nil>' on any pod without
   (init) containers (the common case), feeding defect #1. Coalesce to
   an empty array across all 22 affected component health checks.

3. recipes/checks/dynamo-platform: validate-deployment-exists asserted
   a Deployment named 'dynamo-operator', but the chart prefixes it with
   the release name (dynamo-platform-dynamo-operator-controller-manager),
   so the assert never matched and retried to the deadline. Match by the
   stable app.kubernetes.io/name=dynamo-operator label instead.

Verified on an EKS H100 cluster: deployment phase goes from an 8m
timeout (status=other) to PASSED in ~21s; full deployment 4/4 and
conformance 11/11 green.

Deployment-phase health-check validation regressed in the recent
in-process executor + deepened-check stack (NVIDIA#1235/NVIDIA#1245/NVIDIA#1252):

1. inprocess.go: runAssertWithRetry/runErrorWithRetry retried ANY
   non-nil error, so a permanent JMESPath evaluation error was retried
   for the entire assert window (6m) instead of failing fast like the
   old chainsaw binary did. Classify assertion-engine errors as
   ErrCodeInvalidRequest (terminal) and short-circuit the retry loops
   on them. Adds a regression test asserting terminal eval errors
   fail fast (< AssertRetryInterval) rather than retrying to deadline.

2. recipes/checks/*: the (init)containerStatuses[?...] | length(@)
   projection throws 'invalid type for: <nil>' on any pod without
   (init) containers (the common case), feeding defect #1. Coalesce to
   an empty array across all 22 affected component health checks.

3. recipes/checks/dynamo-platform: validate-deployment-exists asserted
   a Deployment named 'dynamo-operator', but the chart prefixes it with
   the release name (dynamo-platform-dynamo-operator-controller-manager),
   so the assert never matched and retried to the deadline. Match by the
   stable app.kubernetes.io/name=dynamo-operator label instead.

Verified on an EKS H100 cluster: deployment phase goes from an 8m
timeout (status=other) to PASSED in ~21s; full deployment 4/4 and
conformance 11/11 green.

Deployment-phase health-check validation regressed in the recent
in-process executor + deepened-check stack (NVIDIA#1235/NVIDIA#1245/NVIDIA#1252):

1. inprocess.go: runAssertWithRetry/runErrorWithRetry retried ANY
   non-nil error, so a permanent JMESPath evaluation error was retried
   for the entire assert window (6m) instead of failing fast like the
   old chainsaw binary did. Classify assertion-engine errors as
   ErrCodeInvalidRequest (terminal) and short-circuit the retry loops
   on them. Adds a regression test asserting terminal eval errors
   fail fast (< AssertRetryInterval) rather than retrying to deadline.

2. recipes/checks/*: the (init)containerStatuses[?...] | length(@)
   projection throws 'invalid type for: <nil>' on any pod without
   (init) containers (the common case), feeding defect #1. Coalesce to
   an empty array across all 22 affected component health checks.

3. recipes/checks/dynamo-platform: validate-deployment-exists asserted
   a Deployment named 'dynamo-operator', but the chart prefixes it with
   the release name (dynamo-platform-dynamo-operator-controller-manager),
   so the assert never matched and retried to the deadline. Match by the
   stable app.kubernetes.io/name=dynamo-operator label instead.

Verified on an EKS H100 cluster: deployment phase goes from an 8m
timeout (status=other) to PASSED in ~21s; full deployment 4/4 and
conformance 11/11 green.