fix: distinguish failed image-update checks from "up to date" (#1470)

* fix: distinguish failed image-update checks from "up to date"

The image-update detector collapsed every failure (registry unreachable,
missing auth, rate limit, unresolved local digest) into hasUpdate:false and
dropped the captured reason, so a failed check was indistinguishable from a
current image and never raised a notification, even while a manual stack
update still pulled a newer image.

Detection now records a tri-state per stack (ok / partial / failed) with the
failure reason, exposed via a new GET /api/image-updates/detail (the boolean
GET / is unchanged so fleet aggregation is unaffected). A fully-failed check
preserves the last known has_update, so a transient outage neither erases a
real update nor flaps the notification state. The sidebar shows a muted
"couldn't check" indicator with the reason on hover, and the Update board
lists stacks whose check failed in a "could not be checked" advisory.

Detector hardening: the manifest digest lookup issues HEAD first (falling back
to GET) so it no longer draws down Docker Hub's anonymous pull-rate budget, and
local RepoDigest matching is normalized so official library/* images resolve
their digest instead of falling through to a silent "no update".

* fix: preserve confirmed updates through partial checks; tighten failure surfacing

Address review findings on the tri-state image-update detection:

- A partial check (some images errored) no longer erases a previously
  confirmed update; only a fully-ok check can lower has_update, so a single
  image's registry blip cannot drop the stack's update and re-fire the
  notification on recovery. Adds a regression test.
- The image-level catch stores getErrorMessage(e) rather than raw String(e),
  since that value surfaces verbatim in the sidebar tooltip and readiness
  advisory.
- useImageUpdates and the readiness detail fetch now log unexpected non-ok
  responses instead of silently leaving stale state.
- Remove an unused checkFailedCount derivation (the row indicator is driven by
  the checkStatus prop).
- Reword the recordStackCheckFailure docstring and the HEAD-first comment.

frontend/src/components/__tests__/AutoUpdateReadinessView.test.tsx

@@ -124,6 +124,48 @@ describe('AutoUpdateReadinessView desktop Apply now', () => {
   });
 });
 
+/**
+ * Local-node stacks whose latest check could not determine status never appear
+ * in the card grid (which lists confirmed updates only), so the readiness view
+ * surfaces them in a "could not be checked" advisory fed by a parallel local
+ * /image-updates/detail fetch.
+ */
+describe('AutoUpdateReadinessView check-failed advisory', () => {
+  const mockedFetch = apiFetch as unknown as ReturnType<typeof vi.fn>;
+  const mockedFetchForNode = fetchForNode as unknown as ReturnType<typeof vi.fn>;
+
+  afterEach(() => {
+    mockedFetch.mockReset();
+    mockedFetchForNode.mockReset();
+  });
+
+  it('lists local stacks whose check failed, with the reason', async () => {
+    mockedFetch.mockImplementation((url: string) => {
+      if (url === '/image-updates/fleet') return Promise.resolve({ ok: true, json: async () => ({}) });
+      if (url.startsWith('/scheduled-tasks')) return Promise.resolve({ ok: true, json: async () => [] });
+      if (url === '/image-updates/detail') {
+        return Promise.resolve({
+          ok: true,
+          json: async () => ({
+            grafana: { hasUpdate: false, checkStatus: 'failed', lastError: 'Registry unreachable for ghcr.io/acme/grafana:latest', checkedAt: 1 },
+            web: { hasUpdate: false, checkStatus: 'ok', lastError: null, checkedAt: 1 },
+          }),
+        });
+      }
+      return Promise.resolve({ ok: true, json: async () => ({}) });
+    });
+    mockedFetchForNode.mockResolvedValue({ ok: true, json: async () => null });
+
+    render(<AutoUpdateReadinessView />);
+
+    expect(await screen.findByText(/could not be checked/i)).toBeInTheDocument();
+    expect(screen.getByText('grafana')).toBeInTheDocument();
+    expect(screen.getByText(/Registry unreachable for ghcr.io\/acme\/grafana:latest/)).toBeInTheDocument();
+    // An ok stack with no update must not appear in the advisory.
+    expect(screen.queryByText('web')).toBeNull();
+  });
+});
+
 /**
  * CadenceStrip surfaces the control instance's detection cadence by the
  * readiness card: a past last-check must read as an "ago" value (not the