Use anonymously pullable CI images

.gitea/workflows/release.yml

@@ -12,7 +12,9 @@
 #     plus install.sh / install.ps1 / the systemd unit baked in under
 #     /opt/restic-manager/dist (the read-only fallback path the server
 #     handlers use when <DataDir>/... is empty).
-#   * Pushes to zot OCI registry (docker.dcglab.co.uk).
+#   * Pushes to the public namespace in the zot OCI registry
+#     (docker.dcglab.co.uk/public/restic-manager). Pulls are anonymous;
+#     pushes remain authenticated.
 #
 # Tag fan-out
 #   * tag push: :vX.Y.Z, :X.Y, :X
@@ -29,7 +31,7 @@ on:
 
 env:
   REGISTRY: docker.dcglab.co.uk
-  IMAGE_NAME: restic-manager
+  IMAGE_NAME: public/restic-manager
 
 # Force bash as the default shell — see ci.yml header.
 defaults:
@@ -41,10 +43,7 @@ jobs:
     name: Build + push image
     runs-on: ubuntu-latest
     container:
-      image: docker.dcglab.co.uk/ci-runner-go:2026-05-15
-      credentials:
-        username: ${{ secrets.ZOT_USERNAME }}
-        password: ${{ secrets.ZOT_PASSWORD }}
+      image: docker.dcglab.co.uk/public/ci-runner-go:latest
     steps:
       - uses: actions/checkout@v4