Return 502 Bad Gateway when OCI skill pull fails

[samuv]

Summary

• Follow-up on review feedback from Add GetContent API for on-the-fly SKILL.md retrieval from OCI and git sources #4810 (discussion): registry.Pull failures in getContentFromOCI and installFromOCI were mapped to 400 Bad Request, but auth errors, unreachable registries, missing manifests, and network timeouts are upstream failures the caller cannot fix by changing their input.
• Return 502 Bad Gateway instead, matching the git-resolve path in getContentFromGit which already uses 502 for the equivalent upstream failure.
• Parse / validation / "reference not found locally and registry not configured" paths continue to return 400 — those are genuine caller errors.

Type of change

• Bug fix (HTTP status semantics)

Test plan

• Unit tests (go test ./pkg/skills/skillsvc/...)
• Existing tests updated to assert 502 where appropriate; 400 assertions for parse / missing-registry / invalid-reference cases left intact

Changes

File	Change
pkg/skills/skillsvc/content.go	getContentFromOCI: StatusBadRequest → StatusBadGateway on registry.Pull failure
pkg/skills/skillsvc/install_oci.go	installFromOCI: StatusBadRequest → StatusBadGateway on registry.Pull failure
pkg/skills/skillsvc/content_test.go	Rename pull failure propagates as 400 → ...as 502; assert StatusBadGateway
pkg/skills/skillsvc/install_oci_test.go	Update wantCode to StatusBadGateway in four pull-failure fall-back tests (explicit tag, qualified name, digest ref, multi-segment ref)

Does this introduce a user-facing change?

Yes — API clients that previously received 400 Bad Request on a remote OCI pull failure now receive 502 Bad Gateway. This is a more accurate signal that the failure originated upstream (registry/network) rather than from a malformed request, and matches the behaviour already in place for git pulls (and already documented in the swagger annotation introduced in #4810).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.48%. Comparing base (b2f6717) to head (8e2660a).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4956      +/-   ##
==========================================
- Coverage   69.49%   69.48%   -0.01%     
==========================================
  Files         551      551              
  Lines       55817    55817              
==========================================
- Hits        38788    38786       -2     
- Misses      14041    14043       +2     
  Partials     2988     2988              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[jhrozek]

One small follow-up on the swagger side (non-blocking, feel free to punt to a separate PR):

installFromGit already returns 502, and with this change installFromOCI does too — but the @Failure list on installSkill in pkg/api/v1/skills.go still only advertises 400/409/500. Might be worth adding @Failure 502 {string} string "Bad Gateway" there and regenerating the swagger docs so clients see the real contract. Pre-existing gap, not introduced here.