Retry transient registry failures during image preparation

## Problem

The image preparation step is still not retried. `prepare_for_pull()` fetches the manifest through `OpenImage`, which can fail transiently because of DNS, TCP, or registry errors.

For example:

```text
failed to invoke method OpenImage: fetching manifest:
dial tcp ...:443: connect: connection refused
```

`containers-image-proxy-rs` currently reports this as an opaque `RequestInitiationFailure`. bootc cannot safely distinguish transient network failures from permanent failures such as:
- missing images or manifests
- invalid image references
- signature-policy rejection
Retrying every `RequestInitiationFailure` would unnecessarily delay permanent errors.

## Desired behavior

bootc should apply its bounded registry retry policy to transient failures during image preparation as well as blob downloads, while returning permanent failures immediately.
This likely requires typed retryability information from `containers-image-proxy-rs` instead of parsing error strings.

Start at prepare_for_pull() and its OpenImage manifest fetch, then inspect how blob downloads apply the bounded registry retry policy. Trace the RequestInitiationFailure from containers-image-proxy-rs and determine how transient versus permanent failures are represented. Done means transient DNS, TCP, and registry failures retry during preparation while missing images, invalid references, and signature-policy rejections return immediately.

Written by the indexing model from the issue text.