The push to GHCR is refused

What broke

The belt builds the image, then the push stops with permission_denied.

Your job

Give the token only the key it needs (lines 5–6).