deploy: log out of ghcr, so a dead token stops breaking later pulls

GITHUB_TOKEN expires with the workflow run, but `docker login` writes it
to /root/.docker/config.json on the host, where it stays. Docker then
presents that dead token on every subsequent pull and does NOT fall back
to anonymous, so even a public image fails with "No such image" -- which
reads as a missing image rather than a stale credential.

This broke deploys of services that have nothing to do with this workflow.
The workaround each time was to delete the ghcr.io auth entry by hand,
pull, and restore it; the stale entry has now been removed from the host
as well.

Uses a trap on EXIT rather than a trailing command so the logout also runs
when a pull or a stack deploy fails -- the failure case is exactly when a
half-finished run would otherwise leave the credential behind.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YLYiaPYror1vLKApYKrxTu

.github/workflows/deploy.yml

@@ -17,6 +17,18 @@ jobs:
           host: ${{ secrets.SSH_KNOWN_HOSTS }}
           key: ${{ secrets.SSH_PRIV_KEY }}
           script: |
+            # Always log out, including when a pull or deploy below fails.
+            #
+            # GITHUB_TOKEN dies with the workflow run, but `docker login`
+            # persists it to /root/.docker/config.json on the HOST, where it
+            # outlives the run by however long until someone notices. Docker
+            # then presents that dead token on every later pull and does NOT
+            # fall back to anonymous, so even a public image fails with
+            # "No such image" — which reads like the image is missing rather
+            # than like the credential is stale. Deploys of unrelated services
+            # broke this way, and the workaround each time was to delete the
+            # ghcr.io entry by hand, pull, and put it back.
+            trap 'docker logout ghcr.io >/dev/null 2>&1 || true' EXIT
             cd ~/devops && git pull
             echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin
             docker pull ghcr.io/token-for-token/hosted-gateway:main