The CI workflow was failing with "denied" because it preferred an
expired/invalid CR_PAT over the built-in GITHUB_TOKEN. GITHUB_TOKEN
is the recommended approach for same-repo GHCR pushes — it's
auto-rotated, minimal-scope, and zero-maintenance.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>