[patch] Retry transient main verification

[libops-agent]

Summary

• retry transient GitHub main-ref lookup failures at every image publication gate
• validate the returned SHA and reject true main advancement immediately
• fail closed after bounded backoff without surfacing untrusted response bodies
• execute the shared guard contract against recovery, exhaustion, and mismatch cases

Verification

• go test ./...
• actionlint
• git diff --check