GHCR packages default private on first creation. Add a best-effort gh api PATCH call at the end of both the multi-arch merge job and the cpu build job so any new package version is immediately public without requiring a manual UI step. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>