Harden beats-cve-report against ECR scan/finding consistency lag

[Copilot]

beats-cve-report can observe imageScanStatus=COMPLETE and still fail immediately afterward with ScanNotFoundException when fetching findings for :latest. This PR removes that race by making findings retrieval retry-aware for transient ECR readiness lag.

• Root cause

  • ECR scan status readiness and findings availability are not strictly synchronous.
  • Workflow treated ScanNotFoundException as terminal in the findings fetch step.

• Workflow change (.github/workflows/build.yml)

  • Updated Retrieve ECR enhanced findings step to use a bounded retry loop:
    • timeout: 300s
    • interval: 15s
  • Retries only on ScanNotFoundException.
  • Preserves fail-fast behavior for non-transient AWS errors.

• Behavioral impact

  • No change to report generation logic.
  • Reduces false-negative job failures caused by short ECR propagation delays.

while true; do
  if aws ecr describe-image-scan-findings ... > beats-cve-raw.json 2>scan.err; then
    break
  fi
  grep -q "ScanNotFoundException" scan.err || exit 1
  # retry until timeout
done