fd2df93683
Same arrangement classic-models already uses: a hand-created ghcr-pull-secret rather than one committed or held in Vault, since the credential is a GitHub token that belongs to no estate in particular. Without it the pod would sit in ImagePullBackOff with no hint as to why. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>