Problem

CocoonSet teardown calls DeleteManifest for :hibernate and policy-selected :latest tags even when those manifests were never pushed. Although the client treats a 404 as success, some OCI registries materialize an empty repository while authorizing the DELETE request, leaving repository entries with no tags.

This is common for snapshotPolicy: never: neither teardown snapshot exists, but deleting the CocoonSet still sends registry DELETE requests.

Fix

• Probe each GC candidate with the existing Registry.HasManifest API.
• Call DeleteManifest only when the tag exists.
• Preserve the existing snapshot-policy behavior, including cleanup of stale :latest tags under never and non-main roles under main-only.
• Update the reconcile-loop documentation and add a regression test for absent tags.

The HEAD/DELETE race remains safe because DeleteManifest already treats a missing manifest as success.

Validation

• make fmt-check
• make test
• make lint
• Verified against an OCI registry exhibiting the issue: deleting short-lived snapshotPolicy: never sets no longer created empty repository records.