docker was present on the echolot runner; the login failed because Gitea's container registry does not accept the ephemeral Actions token. Requires a PAT with package read/write scope as the REGISTRY_TOKEN repo secret (REGISTRY_USER optional, defaults to the actor); fails with a self-explanatory error when missing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>