[earakely-scale]

A bundle whose images are in a private registry couldn't run on a recipient's machine with core's default stores, even with Docker logged in to that registry. Writing each image, put_ref checks its ref against the registry, and core reaches a private registry only with the image store's credentials. The local store holds none for it, so the registry answers 401 and the run stops. An ECR image store can read it, but then a run doesn't set up the gateway and service-db envs, which it does only in local stores.

Change

• put_ref records a ref already pinned to a digest as given when its registry refuses to serve it to a store holding no credentials for it. The sandbox's Docker then pulls it with its own login. A tag still has to be resolved, and a refusal of the store's own credentials still fails.
• The README bundle init writes says a digest-pinned image needs only docker login to its registry.

Verified

I exported a bundle from a dev task: two MCP servers whose images are in a private ECR, a universe, an agent, and a rubrics judge. I ran it with this branch installed alongside PyPI dependencies only, core's local stores, and Docker logged in to the registry. It passed 5/5 steps. On 0.9.1394 the same run stops writing its first env, with HTTP 401.

🤖 Generated with Claude Code

Confidence Score: 5/5

The PR appears safe to merge.

Summary

Allows DockerImageArtifact.put_ref to keep a digest-pinned reference after an anonymous registry refusal.

• Digest-pinned images can be registered when the store cannot check their private registry.

_{Reviews (1) · Last reviewed commit: "fix(artifacts): a digest ref its registr..." · Reviewed by Greptile}