Use per-job DOCKER_CONFIG under RUNNER_TEMP so login-action logout on
shared self-hosted runners cannot strip another job's credentials. Drop
broken buildx imagetools rm; untag ci-* handoff labels via the registry
distribution API after publish.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>