image reader waits out a registry 429 and tries again (3 tries); 08 + changelog: the dry-run measurement of the Docker Hub change (0 refused), two runners = two tag caches (R-1334)

scripts/CHANGELOG.md

@@ -7,6 +7,10 @@
   wheel cache (`--tag-cache=` overrides). The log gains `TAGS fetched=… from-cache=… retried-429=…`.
 - Measured before: night job 2446, 211 Docker Hub requests in ~2 min, 15 refused; dry job 2450, 224 in ~3.5 min, 0 refused.
 - Tests: W14 (7 checks; the 429 retry seen failing on the old code — the first 429 ended the image) — 71 checks.
+- Measured after: dry runs 2458 and 2459 (`fe677bae`): 0 Docker Hub 429, 0 retries; 210 requests over ~7 min. The two runs
+  ran on the two different CI runners, so the second found no tag cache (each runner keeps its own).
+- **`image_runtime.py`:** `_get` waits out a 429 (`Retry-After`, else 10/30 s) and tries again, `RETRY_TRIES` = 3 — run 2459
+  had two ghcr.io blob reads refused. `test_image_runtime.py` retry checks (red on the old `_get`: one call, no wait) — 21 checks.
 
 ## 2026-10-28 — the watch remembers a notice per GROUP: a catalog pin and a DooPlex pin of one image are two entries