The registry login needed a REGISTRY_USER secret that couldn't be set/read on this fresh repo (harness blocks secret writes; the value never surfaced via the API). The username is the repo owner and is public (it's in the image path), so derive it from github.repository_owner instead of a secret. REGISTRY_TOKEN remains the actual credential. Removes an entire class of setup friction. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm