Use per-job DOCKER_CONFIG under RUNNER_TEMP so login-action logout on shared self-hosted runners cannot strip another job's credentials. Drop broken buildx imagetools rm; untag ci-* handoff labels via the registry distribution API after publish. Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>