fix: write regctl config.json directly, no registry set command

.gitea/workflows/docker.yml

@@ -78,20 +78,34 @@ jobs:
             -o /usr/local/bin/regctl
           chmod +x /usr/local/bin/regctl
 
-      # Write credentials directly to Docker config (avoids the broken Gitea
-      # token endpoint), then tell regctl to use basic auth for this registry.
+      # Write regctl config directly — avoids any flag compatibility issues and
+      # the broken Gitea Bearer token endpoint. authType=basic forces plain
+      # user:pass on every request with no token exchange.
       - name: Configure registry auth
         if: github.event_name != 'pull_request'
         env:
           REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
           REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
         run: |
-          mkdir -p ~/.docker
-          printf '{"auths":{"%s":{"auth":"%s"}}}' \
-            "$REGISTRY" \
-            "$(printf '%s:%s' "$REGISTRY_USER" "$REGISTRY_PASSWORD" | base64 -w0)" \
-            > ~/.docker/config.json
-          regctl registry set "$REGISTRY" --auth-basic
+          mkdir -p ~/.regctl
+          python3 - <<'EOF'
+          import json, os
+          reg = os.environ["REGISTRY"]
+          cfg = {
+            "hosts": {
+              reg: {
+                "user": os.environ["REGISTRY_USER"],
+                "pass": os.environ["REGISTRY_PASSWORD"],
+                "authType": "basic",
+                "tls": "enabled",
+              }
+            }
+          }
+          path = os.path.expanduser("~/.regctl/config.json")
+          with open(path, "w") as f:
+            json.dump(cfg, f)
+          print(f"Wrote regctl config for {reg}")
+          EOF
 
       - name: Push standard image
         if: github.event_name != 'pull_request'