Private registry credentials were applied while pushing Docker Hub short names. Auto-retag under the credential host and prefix the flattener repo.
Only attach auth when username and password are complete and match the image registry; retry anonymously if ambient auth fails on public pulls.