fix(ci): isolate DOCKER_CONFIG so login skips the host pass credstore

The desktop runner's ~/.docker/config.json uses credsStore: pass, which isn't
initialised, so docker login failed to store creds. Use a throwaway
DOCKER_CONFIG under RUNNER_TEMP (outside the build context) for the job.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.forgejo/workflows/deploy.yml

@@ -41,6 +41,12 @@ jobs:
 
       - name: Log in to the Forgejo registry
         run: |
+          # Isolate Docker's config in a throwaway dir (outside the build context)
+          # so login doesn't use the desktop's credential helper (credsStore: pass,
+          # uninitialised on the runner). Exported so build/push see it too.
+          export DOCKER_CONFIG="${RUNNER_TEMP}/docker"
+          echo "DOCKER_CONFIG=${DOCKER_CONFIG}" >> "$GITHUB_ENV"
+          mkdir -p "${DOCKER_CONFIG}"
           echo "${{ secrets.REGISTRY_TOKEN }}" \
             | docker login "${REGISTRY}" -u "${{ secrets.REGISTRY_USER }}" --password-stdin