Fixes found raising the package registry end-to-end in the lab: seed gitea's DB with plain psql statements (no \gexec, no $$ DO-blocks that clash with the shell); run gitea on the host network so it reaches the substrate store and answers where the builder looks; set gitea ROOT_URL to the machine's loopback so npm's stored credential matches the tarball host; keep the pivot's passwords so a re-run is the same run; create the admin without re-enabling must-change-password. Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx