Bump image manifest resolve timeout to 5s

[sjmiller609]

Summary

Bump the manifest-resolve context timeout in `(*manager).CreateImage` from 2s to 5s (`lib/images/manager.go:123`).

Docker Hub manifest fetches from `prod-yul` intermittently exceed the existing 2s deadline. Observed errors include:

• `resolve manifest: fetch manifest: Get "https://index.docker.io/v2/onkernel/chromium-headful-vgpu/manifests/016335f\": context deadline exceeded`
• `Get "https://index.docker.io/v2/\": context deadline exceeded` (registry probe)
• `Get "https://auth.docker.io/token?scope=...\": context deadline exceeded` (auth token fetch)

Currently surfaces as 500 on `POST /images`. 5s is generous enough to ride out the long-tail without appreciably slowing the failure path under genuine rate-limit / down-registry conditions.

This is a stopgap — the longer-term fix is retry-with-backoff and/or a metro-local registry mirror, but those are bigger changes.

Test plan

• CI green
• Manual: `POST /images` for an existing public image succeeds within the new budget
• Manual: `POST /images` for a bogus manifest fails fast (<5s + RTT) with the same error mapping

---

Note

Low Risk
Low risk: only increases the CreateImage manifest-resolve context deadline from 2s to 5s, affecting request latency only when registries are slow.

Overview
In lib/images/manager.go, increases the manifest resolve timeout in (*manager).CreateImage from 2s to 5s to reduce intermittent context deadline exceeded failures when resolving image digests from remote registries.

^{Reviewed by Cursor Bugbot for commit ec38e69. Bugbot is set up for automated code reviews on this repo. Configure here.}

[firetiger-agent]

Firetiger deploy monitoring skipped

This PR didn't match the auto-monitor filter configured on your GitHub connection:

Any PR that changes the kernel API. Monitor changes to API endpoints (packages/api/cmd/api/) and Temporal workflows (packages/api/lib/temporal) in the kernel repo

Reason: Changes are to image manifest resolution logic in lib/images/manager.go, not to API endpoints (packages/api/cmd/api/) or Temporal workflows (packages/api/lib/temporal) as specified in the filter.

To monitor this PR anyway, reply with @firetiger monitor this.