docs: correct the registry notes in the Dockerfile header

Two things were wrong, and the second actively misled.

The publish instructions described pushing to the Gitea registry by hand.
Publishing now runs on GitHub Actions to ghcr.io, because Cloudflare's
request-body cap returns 413 on a registry layer and our own runners cannot
build images (host mode, all capabilities dropped). The example tag had also
been mangled to "12.11.1-ci".

"Package visibility is PUBLIC, so the runner namespace pulls without a secret"
was false. The Gitea package is private — flux-config's kustomization says so
in as many words — and the runner Deployments have always carried a pull
secret. Reading that line led me to conclude the ghcr package would need no
credential; it does, and forgejo-runner-system now holds
github-registry-credentials for exactly that.

Verified with `docker build --check`: no warnings.

Dockerfile

@@ -6,15 +6,20 @@
 # The runner pod is non-root with all caps dropped, so it cannot apt/apk-add at
 # runtime -- the tools must be baked in here.
 #
-# Build multi-arch (cluster is mixed amd64/arm64) and push to the Gitea registry:
+# PUBLISHING IS AUTOMATED. Run the "build image" workflow on GitHub with a tag
+# (e.g. 12.11.1-ci4); it builds both architectures and pushes to
+# ghcr.io/zegit-zoo/zegit-forgejo-runner. ./push-image.sh remains for building
+# by hand. README.md explains why the registry moved off Gitea (Cloudflare's
+# request-body cap returns 413 on a registry layer) and why the build cannot run
+# on our own runners (host mode, all capabilities dropped).
 #
-#   docker buildx create --use --name zegit-ci 2>/dev/null || true
-#   docker login gitea.langenoja.se        # username + a Gitea personal access token
-#   docker buildx build --platform linux/amd64,linux/arm64 \
-#     -t gitea.langenoja.se/zegit-zoo/zegit-forgejo-runner:12.11.1-ci --push .
+# Then in flux-config set the image on BOTH deployment-zegit-runner and
+# deployment-forgejo-runner, digest-pinned.
 #
-# Then in flux-config set both containers' image: to the tag above and commit.
-# Package visibility is PUBLIC, so the runner namespace pulls without a secret.
+# The image is NOT public. Pulls need a registry credential in
+# forgejo-runner-system -- github-registry-credentials for ghcr.io. An earlier
+# version of this comment claimed the package was public and needed no secret;
+# that was wrong for the Gitea registry too, which is private.
 FROM code.forgejo.org/forgejo/runner:12.11.1
 
 USER root