ci: publish with GHCR_TOKEN/GHCR_USER — REGISTRY_TOKEN never existed

The image job has failed on every run with

  ::error::REGISTRY_TOKEN is unset, so nothing was published. Add the org secret.

The guard is doing its job; the name is simply wrong. The hanzoai org defines
exactly GHCR_TOKEN, GHCR_USER, GH_PAT, KMS_CLIENT_ID, KMS_CLIENT_SECRET,
OCI_TOKEN and OCI_USER. There is no REGISTRY_TOKEN and never was, so the
suggested remedy — add the org secret — would have minted a second credential
for the registry every other repo already logs into with GHCR_*.

Only ui and papers invented that name. Both now use the GHCR_* pair, and take
the username from GHCR_USER instead of hardcoding hanzo-dev, so rotating the
publishing identity stays a single org-level change.

Tagging is untouched: still the short HEAD sha, which is what a CR pins.

.hanzo/workflows/deploy.yml

@@ -26,16 +26,27 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: build and push
+        # GHCR_TOKEN/GHCR_USER, which are the org secrets that actually exist.
+        # This job asked for REGISTRY_TOKEN, which was never defined anywhere —
+        # the org has exactly GHCR_TOKEN, GHCR_USER, GH_PAT, KMS_CLIENT_ID,
+        # KMS_CLIENT_SECRET, OCI_TOKEN, OCI_USER — so the guard below fired on
+        # every run and nothing was ever published. Every other image build in
+        # the org already uses the GHCR_* pair; this file and ui were the two
+        # that invented a name.
+        #
+        # The username comes from the secret too, rather than being hardcoded to
+        # hanzo-dev, so rotating the publishing identity is one org-level change.
         env:
-          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+          GHCR_TOKEN: ${{ secrets.GHCR_TOKEN }}
+          GHCR_USER: ${{ secrets.GHCR_USER }}
         run: |
           set -euo pipefail
-          if [ -z "${REGISTRY_TOKEN:-}" ]; then
-            echo "::error::REGISTRY_TOKEN is unset, so nothing was published. Add the org secret."
+          if [ -z "${GHCR_TOKEN:-}" ] || [ -z "${GHCR_USER:-}" ]; then
+            echo "::error::GHCR_TOKEN/GHCR_USER are unset, so nothing was published."
             exit 1
           fi
           tag="$(git rev-parse --short HEAD)"
           image="ghcr.io/hanzoai/papers:${tag}"
-          echo "${REGISTRY_TOKEN}" | docker login ghcr.io -u hanzo-dev --password-stdin
+          echo "${GHCR_TOKEN}" | docker login ghcr.io -u "${GHCR_USER}" --password-stdin
           docker build -t "${image}" ./site
           docker push "${image}"