* ci: make image pulls resilient to Docker Hub flakiness Intermittent CI failures came from transient Docker Hub registry/auth timeouts (auth.docker.io / registry-1.docker.io) during image pulls at `docker compose run` time. These are timeouts, not rate limits, so authenticating wouldn't help (and can't on fork PRs anyway). For each compose job in apply_pr_checks.yaml: - Configure a docker.io pull-through mirror (mirror.gcr.io) via /etc/docker/daemon.json, bypassing the flaky Docker Hub auth/token path. No secrets, so it still works on fork PRs. - Pre-pull/build the images each job needs in a 3-attempt retry loop before the real steps. Images are then cached locally, so the existing `docker compose run` steps don't hit the registry -- isolating a flaky pull to the retried prep step without masking real lint/build/test failures. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * ci: extract image-prep into a composite action The mirror-config + retry-pull logic was duplicated across all three compose jobs. Extract it into a local composite action (.github/actions/prepare-docker-images) parameterized by the services to pull/build, so each job calls it in one step. Inputs are passed via env rather than interpolated into the run script, matching the repo's zizmor template-injection guard. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * ci: run dockerised checks when CI plumbing changes The check_api_server / check_generated_graphql / frontend jobs are gated by paths-filter on server/** and client/**, so a PR that only touches CI or docker plumbing (this workflow, the compose file, the Dockerfile, the prepare-docker-images action) skipped all of them -- meaning changes to the image-pull setup were never actually exercised in CI. Add those plumbing paths to the server and client filters via a YAML anchor so the relevant jobs run when they change. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>