ci: fall back cleanly when image mirrors are unavailable

Son of Odinrequested to merge
ci-proxy-fallbacks into develop

Two small CI reliability fallbacks, split out of !5179 so that MR stays test-only. Neither changes any shipped binary.

Changes

  • test-simulation (.gitlab-ci.yml): make test-simulation-cluster-native builds its Go binaries in the job container, so it never pulls the Go builder image that .dind-registries probes. If that probe leaves DOCKER_MIRROR unset, the job now keeps using the group dependency proxy for its Docker base and L1 images, as long as the proxy can serve ubuntu:24.04. An explicitly set DOCKER_MIRROR is never overridden.
  • make openapi (Makefile): if the generator image can't be pulled through DOCKER_MIRROR, the target falls back to the same pinned digest (openapi-generator-cli:v6.0.0@sha256:310bd03…) on Docker Hub instead of failing. A local image is reused. With no mirror set, behaviour is unchanged: a failed pull exits 1.

Testing

  • The CI YAML parses, including the !reference tags.
  • make -n openapi expands correctly.
  • This MR's own pipeline runs both paths.

🤖 Generated with Claude Code

Merge request reports