Fix GHCR manifest probe in CI docker-existence gate

[Copilot]

The workflow job “Check if the docker image already exists” was failing before tests/build decisions due to an invalid GHCR manifest request/auth flow. This change stabilizes that gate so missing images are treated as a condition, not a job failure.

• Auth header construction

  • Build GHCR Basic auth from github.actor:GITHUB_TOKEN with newline-safe base64 encoding.
  • Replace placeholder header usage with an actual Authorization: Basic ... header.

• Manifest probe hardening

  • Make the manifest request non-fatal (|| true) so absent tags/images do not crash the job.
  • Parse mediaType from the first manifest response instead of issuing a second request.

• Scope

  • Changes are isolated to .github/workflows/run-tests-update-docker-on-demand.yml in the check-if-docker-image-exists step.

GHCR_TOKEN=$(printf "%s" "${{ github.actor }}:${{ secrets.GITHUB_TOKEN }}" | base64 | tr -d '\n')
manifest=$(curl -sS -H "Authorization: Basic $GHCR_TOKEN" \
  https://${{ env.REGISTRY }}/v2/${{ steps.string.outputs.lowercase }}/manifests/${{ needs.get-docker-meta-data.outputs.version }} || true)
filtered_manifest=$(echo "$manifest" | jq '.mediaType')