f9bc53723f
The pre-pull roles were still blocking the playbook because they retried until success and exhausted their retry budget during registry TLS timeouts. Keep the image pulls as opportunistic cache warmers, but never let them fail the bootstrap; log any missed images instead.