gitea.zb.local resolves but is plain HTTP, which Docker refuses as a
registry without daemon-level insecure-registry config. gitea.zb.lan
resolves but nothing answers there yet (proxy not configured for it).
gitea.zb-kw.duckdns.org is confirmed reachable end-to-end over HTTPS,
including the registry v2 API, from both the runner and the deploy
target, so use that consistently. Also fix aquasecurity/trivy-action's
token-setup-trivy input, which defaults to gitea.token and gets
rejected by github.com when it tries to clone the install script.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
willemjanandClaude Sonnet 5