fix(ci): log in to registry for manifest-only main pushes

The pin step writes manifest PUTs on every main push, but login was gated on services != ''. Manifest-only pushes skipped login and pushed anonymously (401); this only worked before via a stale persistent login on the old runner.

.gitea/workflows/ci.yaml

@@ -390,7 +390,11 @@ jobs:
           echo "services=$(paste -sd, /tmp/services.txt)" >> "$GITHUB_OUTPUT"
 
       - name: Log in to registry
-        if: steps.services.outputs.services != ''
+        # The pin step below also writes (manifest PUTs), and it runs on every
+        # main push — including manifest-only ones where services is empty. A
+        # stale persistent login on the old runner used to mask this; a clean
+        # runner pushes anonymously and gets 401.
+        if: steps.services.outputs.services != '' || github.ref_name == 'main'
         shell: bash
         # Through env, not by substitution into the script. A secret written
         # into a run: block is pasted into the shell source before bash parses