fix: build supplemental images before health check

Supplemental images (e.g. migrations) must be built locally before the
health check runs. Previously, build_push_supplemental ran AFTER
health_check, so on a first-release tag like 0.1.8 the health check
tried to pull a tag that didn't exist yet in GHCR and failed with
'unauthorized'.

New step order:
  docker_build → trivy → build_push_supplemental → health_check → docker_push_ghcr

The migrations image is now in the local Docker cache when health_check
runs, so no GHCR pull is needed. Main image is still only pushed after
the health check passes.

src/jobs/docker_build_push.yml

@@ -57,18 +57,18 @@ steps:
   - docker_build:
       image_name: << parameters.image_name >>
       registry: << parameters.registry >>
+  - restore_trivy_cache
+  - run_trivy_image:
+      image_tag: << parameters.registry >>/<< parameters.image_name >>:${DOCKER_TAG}
+  - save_trivy_cache
+  - build_push_supplemental:
+      supplemental_images: << parameters.supplemental_images >>
+      image_name: << parameters.image_name >>
+      registry: << parameters.registry >>
   - health_check:
       health_path: << parameters.health_path >>
       health_port: << parameters.health_port >>
       health_db: << parameters.health_db >>
       health_migrations: << parameters.health_migrations >>
       health_smoke_paths: << parameters.health_smoke_paths >>
-  - restore_trivy_cache
-  - run_trivy_image:
-      image_tag: << parameters.registry >>/<< parameters.image_name >>:${DOCKER_TAG}
-  - save_trivy_cache
   - docker_push_ghcr
-  - build_push_supplemental:
-      supplemental_images: << parameters.supplemental_images >>
-      image_name: << parameters.image_name >>
-      registry: << parameters.registry >>