A registry pull token does not unlock the repo files beside it

Shipping a self-hosted product from a private repository, a read-packages token was assumed to be enough for a customer to install. It is not: it authorises the image registry only. Anything served from the repository itself -- raw file URLs for a compose file, release assets -- still returns 404 anonymously and needs full repo scope, which is the same disclosure as publishing the source. The realistic split is to send the deployment files directly as a small archive and use the token purely for the image pull. That also removes the release assets from the critical path entirely, provided the running instance serves any client artifacts itself rather than pointing users back at the source host. Worth checking early: an organisation policy can disable public package visibility outright, so the visibility toggle you were counting on may be greyed out with no repo-level way around it.