release: name the image by the public registry host, not the internal server url

tools/release.zig

@@ -1361,7 +1361,18 @@ fn resolve(ctx: *Ctx) !void {
     };
 
     const server = std.mem.trimEnd(u8, ctx.require("GITHUB_SERVER_URL"), "/");
-    const registry = registryHost(server);
+    // The registry host names the image, so it must be the PUBLIC host: inside
+    // the cluster GITHUB_SERVER_URL is http://gitea:3000, and an image called
+    // gitea:3000/... is unpullable outside and unloggable-into by docker,
+    // which refuses plain http. The workflow pins REGISTRY_HOST explicitly;
+    // the derivation below is the fallback for a deployment whose server URL
+    // is already public. The manifest probe stays on GITHUB_SERVER_URL — same
+    // registry, internal route, no TLS dependency in this tool.
+    const registry = reg: {
+        const explicit = ctx.get("REGISTRY_HOST");
+        if (explicit.len != 0) break :reg explicit;
+        break :reg registryHost(server);
+    };
     const repository = lowercase(ctx.arena, ctx.require("GITHUB_REPOSITORY"));
     const image_name = ctx.fmt("{s}/{s}", .{ registry, repository });