ci: drop anonymous-pull check from docker smoke test

[zhanghanduo]

Problem

Every Publish Docker Image run since the initial release has failed — 6 for 6. But the failure moved: the original denied: permission_denied: read_package was a GHCR package-ownership issue (the frontieragent package was created by the old repo, since renamed to FrontierAgentInternal, so this repo's GITHUB_TOKEN had no access). That has been fixed out-of-band by granting this repo Admin access in the package's Manage Actions access settings.

With that resolved, build and push now succeed. The remaining failure is the last step:

Removing login credentials for ghcr.io
Error response from daemon: Head "https://ghcr.io/v2/apodexai/frontieragent/manifests/main": unauthorized   (x6)
##[error]Published image is not anonymously pullable: ghcr.io/apodexai/frontieragent:main

The package is private by org policy. The docker logout + anonymous docker pull block asserts the opposite, so it can never pass — the retry loop just burns ~2 minutes before failing a job whose image was already published successfully.

Change

Drop the anonymous-pull assertion. The checks that actually validate the image are kept, and still run while the job holds its ghcr.io login:

• docker pull the published tag
• docker run --rm "$image" --version
• docker run --rm "$image" python tools/import_smoke.py --stage 2

A comment records why the anonymous check must not be added back, so it does not get "restored" as an apparent omission later.

Note

The repository is public but the image package is private, so external users cannot docker pull the published image. That is a policy decision and is left alone here — worth confirming it matches what the README tells users to do.

[Copilot]

Pull request overview

This PR updates the Docker publish workflow to stop asserting that the just-published GHCR image is anonymously pullable, aligning the smoke test with the org policy that the image package remains private.

Changes:

• Removes the docker logout + anonymous docker pull retry loop that cannot succeed for a private package.
• Keeps the authenticated post-publish validation (docker pull, --version, and tools/import_smoke.py --stage 2) and adds an inline comment explaining the rationale.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.