How can "sfdx force:user:create" be retried?

Question

We are using a Jenfinsfile in Jenkins to execute SFDX commands. The Jenkins user is connected to our Dev Hub.

In one of our builds, we want to create a Customer Portal User, but in a small percentage of cases that create fails because of some asynchronous logic that must complete has not completed. So the simple solution looked like it would be to retry for a few minutes. Note that this works when we don't have to retry.

But we see this sequence...

This added to help debug:

sfdx force:user:display

returns a good expected result (*** replaces some values for security here):

KEY           VALUE
────────────  ──────────────────────────────────────────────────
Access Token  ***
Alias         portal-cveep/master
Id            ***
Instance Url  https://***-dev-ed.cs66.my.salesforce.com/
Login Url     https://CS66.salesforce.com
Org Id        ***
Password      ***
Profile Name  System Administrator
Username      ***

This is the command we want to execute but sometimes fails due to timing:

sfdx force:user:create --definitionfile config/community-user-def.json --json --targetusername ***

with this response:

{
  "status": 1,
  "name": "Error",
  "message": "Insert failed. First exception on row 0; first error: FIELD_CUSTOM_VALIDATION_EXCEPTION, ***: []",
  "exitCode": 1,
  "commandName": "UserCreateCommand",
  "stack": ***
  "warnings": []
}

Then 30 seconds later (and same result for subsequent retries) we retry:

sfdx force:user:display

with this weird result of "unknown" for some values and no password:

=== User Description
KEY           VALUE
────────────  ──────────────────────────────────────────────────
Access Token  ***
Alias         portal-cveep/master
Id            unknown
Instance Url  https://***-dev-ed.cs66.my.salesforce.com
Login Url     https://CS66.salesforce.com
Org Id        ***
Profile Name  unknown
Username      ***

The retry (and same result for subsequent retries):

sfdx force:user:create --definitionfile config/community-user-def.json --json --targetusername ***

now fails for this new reason:

{
  "status": 1,
  "name": "JWTAuthError",
  "message": "Error authenticating with JWT config due to: invalid assertion",
  "exitCode": 1,
  "commandName": "UserCreateCommand",
  "stack": ***,
  "warnings": []
}

I'm baffled as to why this happens, so any ideas appreciated.