Reconstructs the dockerconfigjson pull secret from the discrete GITEA_REGISTRY_USERNAME/GITEA_REGISTRY_TOKEN fields at homelab/prod /registry, via the shared infisical-operator/infisical-auth. Targets parallel-name gitea-registry-infisical; old gitea-registry stays live until cutover. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>