Images are released for unsuccessful PR merges

[ledif]

When a PR is added to a merge queue, the "Build Stable Images" and "Build Latest Images" actions push the succesfully built images to GHCR. However, it's possible that some of the images in the workflow will fail to build, which automatically removes the PR from the merge queue. This leaves us in an inconsistent state where we have published images in the stable-daily or latest streams that contain changes that aren't actually commited to main.

This is what happened when #44 failed to merge, but a user reported that their system automatically pulled in changes from the PR (which have not landed in main).

References:

• The job that pushed stable-daily images despite the latest images failing and removing the PR from the merge queue: https://github.com/ublue-os/aurora/actions/runs/12709477412
• The failed latest job that removed the PR from the merge queue: https://github.com/ublue-os/aurora/actions/runs/12709477414

[ledif]

This is an issue that is known by the Bluefin folks (thanks @m2Giles). Some current workarounds:

• If the build failed because of skew, it's fine to just force merge the PR so that the changes land in main anyway
• If we decide we don't want the merge to occur (for instance, if there's an actual problem with the changes), we can manually delete the tagged packages on GHCR

Both of these require manual intervention. Long term, we can consider modifying the workflow to execute a job on failure that automatically purges the tagged images on GHCR that were created.