Cover the uncovered branches in the image release script (redirect handler, policy-read credential and size bounds, count and shape rejections, EOF manifest scan) and in the Harbor immutability helper (scope-failure verification, absent robot duration, stale-read retries, created-rule ID binding, bounded startup retries). Exclude the __main__ guard like the sibling release script. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>