ci: ghcr login uses the credential luxfi actually provisions

Every job in this file runs on a lux self-hosted pool, so GitHub is not the
executor -- but the login presented `secrets.GITHUB_TOKEN`, which git.hanzo.ai
mints and ghcr.io has never seen:

    Error response from daemon: Get "https://ghcr.io/v2/": denied: denied

The login step failed and every job after it skipped, so the image was never
published. The pair is GitHub`s own idiom and is correct there; it is simply
not a credential anywhere else.

orgs/luxfi provisions exactly GHCR_USER + GHCR_TOKEN. Named directly rather
than through a `||` chain: a missing org secret evaluates to "", so a fallback
silently swaps credentials and the log never says which one was used -- that is
what made the same failure in luxfi/trader read as a registry problem.

Co-authored-by: Hanzo Dev <[email protected]>

.github/workflows/docker.yml

@@ -27,8 +27,16 @@ jobs:
       - uses: docker/login-action@v3
         with:
           registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          # ghcr.io, from a self-hosted runner. `secrets.GITHUB_TOKEN` is minted by
+          # git.hanzo.ai and ghcr.io has never seen it, so the login answered
+          #   denied: denied
+          # and every job after it skipped. On GitHub that pair is correct and this
+          # file was written for GitHub; every job here runs on a lux self-hosted
+          # pool, so GitHub is not the executor and its token is not a credential.
+          # orgs/luxfi provisions exactly GHCR_USER + GHCR_TOKEN — no GH_PAT, and a
+          # missing org secret is "", so a `||` chain would hide which one was used.
+          username: ${{ secrets.GHCR_USER }}
+          password: ${{ secrets.GHCR_TOKEN }}
       - name: Compute tags
         id: meta
         run: |