fix(ci): fix staging release

[kmannislands]

The staging release workflow has two independent failures.

1. It referenced a buildkitd image it never built

Error response from daemon: failed to resolve reference
"ghcr.io/earthbuild/earthbuild:buildkitd-staging-<sha>-latest": not found

build-earthly.yml computes TAG_SUFFIX from RUNS_ON (so ubuntu-26.04 for the staging caller) and pushes +ci-release under that suffix — but its own "Save buildkitd image tarball" / "Build earth binary artifact" steps, and all five Retrieve earthbuild from build-earthly job steps in ci-staging-deploy.yml, re-derived the suffix as latest.

-latest is what the CI workflow (ci.yml) pushes. Both workflows fire on the same push to main, so the staging release was implicitly depending on a run it has no edge to — which is exactly the "wrong point in the graph / missing dependency" symptom: it fails immediately on the commit, and succeeds if you retry it after CI has finished. The staging workflow's own build-earthly job meanwhile pushed -ubuntu-26.04 images that nothing consumed.

Fix: build-earthly.yml now exposes the suffix it actually pushed as a workflow_call output, and the callers use it instead of assuming one. The workflow is now self-contained — no cross-workflow ordering required.

2. pull ping error in the release-dockerhub jobs

Error: pull ping error: pull ping response: rpc error: code = Unknown desc = image pull:
  command failed: docker pull 127.0.0.1:40511/sess-.../pullping:img-5
failed to copy: httpReadSeeker: failed open: ... EOF

./release+release-dockerhub builds multi-platform images and --pushes them to ghcr. Without --no-output, EarthBuild also loads them back into the runner's docker daemon through the embedded registry — the pull-ping path that keeps failing (see #912 and Janis's comment on #884).

Nothing in those jobs needs the local copy: the smoke tests run docker run ghcr.io/earthbuild/earthbuild:<tag>, which pulls the image --push just published. So both release-dockerhub invocations now pass --no-output.

Chose --no-output over --ci deliberately: --ci also implies --strict, which is a broader behaviour change than this needs.

release-binaries intentionally keeps output enabled — +signed-release writes the release artifacts to ./release/release/, so --no-output would break it. copy-buildkitd-to-dockerhub is untouched: it is RUN --push skopeo only, with no SAVE IMAGE to output.

Testing

Branch name ends in -staging-test, so the staging release workflow runs on this PR branch.

🤖 Generated with Claude Code

[github-actions]

⚠️ Are we earthbuild yet?

Warning: "earthly" occurrences have increased by 6 (0.21%)

📈 Overall Progress

Branch	Total Count
main	2815
This PR	2821
Difference	+6 (0.21%)

---

Keep up the great work migrating from Earthly to Earthbuild! 🚀

💡 Tips for finding more occurrences

Run locally to see detailed breakdown:

./.github/scripts/count-earthly.sh

Note that the goal is not to reach 0.
There is anticipated to be at least some occurrences of earthly in the source code due to backwards compatibility with config files and language constructs.

[janishorsts]

LGTM. Unifying the TAG is neat.