It's wrong and likely problematic to release operator-bundle which references images where the pipelines got to the point where they built and pushed images but failed at later stages. When these pipelines are re-ran, they produce different images (i.e. with different digests) whereas the operator-bundle would currently references the ones built before.

We should make the operator-bundle build pipeline fail if any of the pipelines it waits for did not fully complete successfully.

For this we can modify wait-for-image task to also check the presence of attestation on the image. The attestation is supposed to be put there by Tekton Chains after the pipeline fully completed.

Also modify retag pipeline to fail the same way.

Old ticket description was about this:
Ensure each pipeline run tags images with unique (non-floating) tags.
See https://redhat-internal.slack.com/archives/C05TS9N0S7L/p1747732124235149
Similar to ROX-29410