User approval: the test-only autocoder-test-reader may read AutoCoder private OCI packages through a package-read-only Gitea team; no repository or issue write access is authorized.
Changed Gitea organization AutoCoder team TestPackageReaders (ID 17) to include repository AutoCoder/AutoCoder-Engine. The team already contained only autocoder-test-reader (ID 18). Its observed permission remains none, units_map is only repo.packages: read, and includes_all_repositories is false. No Kubernetes secret or deployment was changed. The existing autocoder-test-registry-cred points to this account.
Readback: team repository association returned HTTP 200 and only AutoCoder/AutoCoder-Engine in the team repository list. Using the existing test pull credential, authenticated GET of backend and frontend OCI manifests by their recorded SHA-256 digests both returned HTTP 200 and matching Docker-Content-Digest headers. The current test engine remains unready for a separate GLIBC_2.38/GLIBC_2.39 instruction-init binary mismatch; this grant does not establish a healthy test deployment.
Rollback: remove AutoCoder/AutoCoder-Engine from team 17 after confirming no test deployment needs private image pulls. Do not remove the test account or stored pull secret as part of this permission rollback without separate review.