Check if an image is anonymously pullable with curl only (no docker)

To verify that a published image can actually be pulled, skip docker logout and use the registry v2 token flow. (1) curl -s -o /dev/null -D - https://<host>/v2/ and read realm= and service= from the WWW-Authenticate header. It has to be a GET: ghcr.io answers HEAD /v2/ with 405 and no challenge. (2) curl "$realm?service=$svc&scope=repository:<path>:pull" and take .token. (3) curl -I -H "Authorization: Bearer $tok" -H 'Accept: application/vnd.oci.image.index.v1+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.docker.distribution.manifest.v2+json, application/vnd.oci.image.manifest.v1+json' https://<host>/v2/<path>/manifests/<tag>. Docker Hub's host is registry-1.docker.io, and official images need a library/ prefix. Observed: postgres:16 200, a missing tag 404, a public ghcr image 200, and a nonexistent ghcr repo 403 rather than 404, so treat anything but 200 as not pullable. List every image in a compose file first with the standalone Compose binary's docker-compose config --images (v5.6.1); it needs no daemon and includes the image: names of build: services.