fix: remove --tls insecure; requires Gitea ROOT_URL set to HTTPS

.gitea/workflows/docker.yml

@@ -78,16 +78,15 @@ jobs:
             -o /usr/local/bin/regctl
           chmod +x /usr/local/bin/regctl
 
-      # Configure regctl with basic auth and tls=insecure to avoid the ping that
-      # follows the HTTPS→HTTP redirect Gitea advertises for its token endpoint.
+      # Configure regctl with basic auth. Requires Gitea ROOT_URL to be set to
+      # the HTTPS URL so its token endpoint is advertised as https://, not http://.
       - name: Configure registry auth
         if: github.event_name != 'pull_request'
         run: |
           regctl registry set ${{ env.REGISTRY }} \
             -u ${{ secrets.REGISTRY_USER }} \
             -p ${{ secrets.REGISTRY_PASSWORD }} \
-            --auth-basic \
-            --tls insecure
+            --auth-basic
 
       - name: Push standard image
         if: github.event_name != 'pull_request'