ci: the PAT step falls back to the one credential luxfi provisions

The ghcr login was fixed, and the very next step still failed:

    Resolve cross-repo PAT for private luxfi/* deps -> failure
    Build & push (amd64)                            -> skipped

because it reads GH_TOKEN then UNIVERSE_PAT, and orgs/luxfi provisions neither.
Measured: repos/luxfi/<name> has no secrets at all, and orgs/luxfi holds exactly
GHCR_USER + GHCR_TOKEN. Both names therefore evaluate to "" and the step exits 1.

GHCR_TOKEN is a real GitHub PAT -- it has to be, because ghcr.io accepts nothing
else -- so it can resolve private modules as well as pull images. Added as a
third rung that REPORTS which secret it used (`Using secret: $src`), rather than
a `||` chain that swaps credentials silently. Same fix already proven green in
luxfi/trader.

Co-authored-by: Hanzo Dev <[email protected]>

.github/workflows/docker.yml

@@ -38,9 +38,14 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GH_TOKEN }}
           UNIVERSE_PAT: ${{ secrets.UNIVERSE_PAT }}
+          # orgs/luxfi provisions GHCR_TOKEN + GHCR_USER and nothing else -- no
+          # GH_PAT, no UNIVERSE_PAT. GHCR_TOKEN must be a real GitHub PAT for
+          # ghcr.io to accept it, so it can resolve private modules too.
+          GHCR_TOKEN: ${{ secrets.GHCR_TOKEN }}
         run: |
           tok="$GH_TOKEN"; src="GH_TOKEN"
           if [ -z "$tok" ]; then tok="$UNIVERSE_PAT"; src="UNIVERSE_PAT"; fi
+          if [ -z "$tok" ]; then tok="$GHCR_TOKEN"; src="GHCR_TOKEN"; fi
           if [ -z "$tok" ]; then
             echo "::error::No GH_TOKEN or UNIVERSE_PAT secret set — go mod download / package push will fail on private luxfi/*"
             exit 1