The Docker generate qualification shards flake on every release today (proxy.golang.org reads, missing agent download), and --failed re-runs leave the aggregate red #1263

Observed on 2026-10-30/31 across releases v0.1.227–v0.1.233: codefly publish patch merges the release PR and then refuses to tag because a merge-group or push run of "Docker generate qualification" is red. Each time the red was a shard (generate (N)) failing on a proxy.golang.org stream/read error or on codefly add service … --agent go-grpc → "no such file or directory" (the agent download did not land), never on code; the shards pass on re-run. Two consequences:

1. Every release needs a hand re-run and a hand tag (the tag publish would have pushed), five times in one day.
2. gh run rerun --failed re-runs only the shards; the aggregate docker-generate ("Read the shards' outcome") keeps the first attempt's verdict and stays red, so the whole run must be re-run.

Asked: (a) make the shards resilient to the proxy (GOFLAGS=-mod=mod with GOPROXY fallback direct, or a module cache warmed once per run and shared with the shards; retry the agent download with a clear refusal naming the URL and status); (b) have the aggregate read the latest attempt's outcomes (or re-run with the shards); (c) have publish distinguish a required-check red from a non-required qualification red, or re-check once after the shards' re-run before refusing to tag. Evidence: runs 41060898674 (attempts 1–3), 41138534803 (attempt 2 shards green, aggregate red), release PRs #1244 (closed by publish), #1261 (closed by publish).

🤖 Generated with Claude Code