How to troubleshoot, getting stuck after first line of `...Storing image for indexing`

My job gets stuck/fails (repeatedly after reruns/retries) after outputting:
...Storing image for indexing

I'm using it like this:

name: Docker image

on:
  push:
    branches:
      - master
  pull_request:
  merge_group:

env:
  IMAGE: my.regist.ry/my/image

jobs:
  build:
    runs-on: ubuntu-latest
    name: Build & test
    permissions:
      contents: read
      id-token: write
      statuses: write
      checks: write
      pull-requests: write
    steps:

      - name: Setup Docker (Buildx)
        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3

      # [...]

      - name: Setup Docker (Docker Hub login, for Docker Scout)
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3
        with:
          username: ${{ vars.SECRET_USERNAME }}
          password: ${{ secrets.SECRET_TOKEN }}

      - name: Build image
        uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5
        with:
          push: false
          tags: ${{ env.IMAGE }}:${{ github.sha }},${{ env.IMAGE }}:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max
          load: true # so we can run tests on the image, here in the same workflow

      # [...]

      - name: Docker Scout
        if: ${{ github.event_name == 'pull_request' && !cancelled() }}
        uses: docker/scout-action@b7413c99043c2a9131c0fa39cedaece80f285788 # v1.2.2
        with:
          command: compare
          image: ${{ env.IMAGE }}:${{ github.sha }}
          to: ${{ env.IMAGE }}:latest
          ignore-unchanged: true
          only-severities: critical,high
          write-comment: true

And this is what it looks like when it gets stuck:

Followed by:
The runner has received a shutdown signal. This can happen when the runner service is stopped, or a manually started runner is canceled.

Start with the Docker Scout workflow step and the logs immediately after Storing image for indexing, then compare them with the runner shutdown message. Reproduce the workflow using the shown compare configuration and determine what prevents the action from completing; done means the cause is documented and a comparable run finishes successfully.