one docker config per runner, not one per machine

Five runner services share this user, so they share ~/.docker/config.json, and
docker/login-action logs out in its post step. A job that finishes takes the
credential out from under a job still pushing, which surfaces as
'unauthenticated' or a request for an anonymous token — intermittently, and
never in the job that caused it. RUNNER_TEMP is per runner.

Co-authored-by: Hanzo Dev <[email protected]>

.github/workflows/image.yml

@@ -31,6 +31,11 @@ jobs:
           - arch: arm64
             pool: linux-arm64
     runs-on: ['${{ matrix.pool }}']
+    env:
+      # Each runner gets its own, because five services share this
+      # machine’s HOME and docker/login-action logs out when a job ends —
+      # taking the credential from whichever job is still pushing.
+      DOCKER_CONFIG: ${{ runner.temp }}/docker
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@v4
@@ -54,6 +59,11 @@ jobs:
   merge:
     needs: image
     runs-on: [linux-amd64]
+    env:
+      # Each runner gets its own, because five services share this
+      # machine’s HOME and docker/login-action logs out when a job ends —
+      # taking the credential from whichever job is still pushing.
+      DOCKER_CONFIG: ${{ runner.temp }}/docker
     permissions:
       packages: write
     steps: