ci: fix prune-registry registry ref case and protect signatures

The registry path is lowercase, so the capitalized owner made skopeo inspect
fail and every cosign .sig tag was deleted. Lowercase the owner and, if no
digest resolves, keep all signature tags instead of deleting them.

prune-registry.sh

@@ -18,7 +18,8 @@ REGISTRY_HOST="${REGISTRY_HOST:-$(printf '%s' "${GITEA_URL}" | sed -E 's#https?:
 TOKEN="${REGISTRY_TOKEN:?REGISTRY_TOKEN (write:package) is required}"
 AUTHFILE="${AUTHFILE:-${HOME}/.docker/config.json}"
 API="${GITEA_URL%/}/api/v1/packages/${OWNER}/container/${IMAGE}"
-IMAGE_REF="${REGISTRY_HOST}/${OWNER}/${IMAGE}"
+# Registry paths are lowercase (the Gitea API owner is not).
+IMAGE_REF="${REGISTRY_HOST}/$(printf '%s' "${OWNER}" | tr '[:upper:]' '[:lower:]')/${IMAGE}"
 
 # Collect all versions (paginated).
 versions=""
@@ -41,13 +42,24 @@ for d in "${DISTROS[@]}"; do
   [[ -n "${newest}" ]] && keep["${newest}"]=1
 done
 
-# Keep the cosign signature of each kept image tag.
+# Keep the cosign signature of each kept image tag. If no digest could be
+# resolved, keep every signature tag rather than risk deleting a needed one.
+resolved=0
 for tag in "${!keep[@]}"; do
   [[ "${tag}" == sha256-* ]] && continue
   digest="$(skopeo inspect --authfile "${AUTHFILE}" --format '{{.Digest}}' \
     "docker://${IMAGE_REF}:${tag}" 2>/dev/null || true)"
-  [[ -n "${digest}" ]] && keep["sha256-${digest#sha256:}.sig"]=1
+  if [[ -n "${digest}" ]]; then
+    keep["sha256-${digest#sha256:}.sig"]=1
+    resolved=1
+  fi
 done
+if [[ "${resolved}" -eq 0 ]]; then
+  echo "WARNING: could not resolve any image digest; keeping all signature tags"
+  while IFS= read -r v; do
+    [[ "${v}" == sha256-* ]] && keep["${v}"]=1
+  done <<< "${versions}"
+fi
 
 # Delete everything else.
 while IFS= read -r v; do