Always pull latest image and serialize publishes per image tag

pull_or_build_image() only pulled/built when the image was entirely
absent locally, so any node with a cached tag kept running stale code
indefinitely even after CI published a newer image. It now always
pulls first, falling back to the local image or a build only if the
registry is unreachable.

publish.yml had no concurrency guard, so near-simultaneous pushes to
master (e.g. two PRs merged in quick succession) could race to push
the same :latest tag, and whichever job finished last won regardless
of commit order - this is what caused #169's header-dedup fix to be
silently overwritten by #168's slower-finishing publish job. Adding a
per-image concurrency group serializes those pushes so the newest
commit always publishes last.

Author: szachovy

.github/workflows/publish.yml

@@ -14,6 +14,9 @@ jobs:
     permissions:
       contents: "read"
       packages: "write"
+    concurrency:
+      group: "publish-${{ matrix.image }}"
+      cancel-in-progress: false
     strategy:
       fail-fast: false
       matrix:

src/container.py

@@ -103,11 +103,11 @@ def __init__(self, container: str | None) -> None:
     @staticmethod
     def pull_or_build_image(client: docker.client.DockerClient, image: str, build_context: str) -> None:
         try:
-            client.images.get(image)
-        except docker.errors.ImageNotFound:
+            client.images.pull(image)
+        except (docker.errors.DockerException, requests.exceptions.RequestException):
             try:
-                client.images.pull(image)
-            except (docker.errors.DockerException, requests.exceptions.RequestException):
+                client.images.get(image)
+            except docker.errors.ImageNotFound:
                 client.images.build(path=build_context, tag=image)
 
     def run_command_on_the_container(