Supplemental images (e.g. migrations) must be built locally before the
health check runs. Previously, build_push_supplemental ran AFTER
health_check, so on a first-release tag like 0.1.8 the health check
tried to pull a tag that didn't exist yet in GHCR and failed with
'unauthorized'.
New step order:
docker_build → trivy → build_push_supplemental → health_check → docker_push_ghcr
The migrations image is now in the local Docker cache when health_check
runs, so no GHCR pull is needed. Main image is still only pushed after
the health check passes.
james.maes