After #135054 the images are pushed under the attempt ref (rc.N-vX.Y.Z),
and promote_stable only moved stable/latest, so :vX.Y.Z and
:vX.Y.Z-desktop were never created. The publication pass now tags both
variants with the final release tag alongside the stable/latest aliases,
from the attempt's digest, and reads each back. The final tag still only
appears at publish, so an earlier attempt cannot collide with it.
desktop preparation parses its claim ref and carries the attempt ref as
archive_tag beside the plain payload version. Stable admission accepts
only attempt refs and returns them; accepted candidates, bootstrap and
advance_stable read the attempt-scoped archive, and docker manifests may
carry the attempt-ref image tag while stable/latest aliases stay put
until publish.
ethernet