fix(885): a challenge-less 401 lands in the TOKEN-LEG arm, not the never-asked one — the table and the comment said otherwise

The row added for the third refusal shape was written as "401 / 403 carrying NO
`Www-Authenticate` challenge at all", and the script comment beside it made the same
binding. Both are wrong for the 401 half: `probe` enters the token leg on a 401, so
a challenge-less 401 DOES call `acquire_token`, which sets `token_leg_done=1` and
abandons for want of a realm — it reports `could NOT OBTAIN an anonymous pull
token`, the row above. Only a FIRST-READ 403 reaches the never-asked arm. The
parametrised test already drives both codes and asserts exactly that split; the
prose beside them did not match it.

The three rows now bind one shape each: a refusal surviving a bearer the run really
obtained, a 401 whose token leg yielded none (no challenge header, no realm, or no
token in the answer), and a first-read 403 that asked for nothing.

Prose between arms regenerates mis-bindings — which is why the arms are stated as
one self-binding row apiece rather than as a category sentence covering two.

Refs #885

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV

docs/ci-cd.md

@@ -2452,9 +2452,9 @@ because they send you to different places:
 | HTTP 200 with a manifest body | green | resolves |
 | HTTP 404 | **red** | `IS GONE` — rebuild the tag (recovery above) |
 | HTTP 200, body is not a manifest | **red** | something is answering for the registry (proxy, login page) |
-| 401 / 403 after a token was obtained | **red** | the registry `refused an ANONYMOUS read` — check that `timothy/ersatztv` and its `ersatztv-ci` package are still PUBLIC |
-| the challenge names no realm, or the token endpoint answers with no token | **red** | `could NOT OBTAIN an anonymous pull token` — worded apart on purpose: this is about the registry's token endpoint, not the package's visibility. Not retried |
-| 401 / 403 carrying NO `Www-Authenticate` challenge at all | **red** | `refused an ANONYMOUS read ... WITHOUT issuing a Bearer challenge` — no token was ever requested, because `probe` enters the token leg on a `401` only. An answer about ACCESS to the registry (visibility, or something answering for it) |
+| 401 / 403 that survives a bearer the run actually obtained | **red** | the registry `refused an ANONYMOUS read ... even after a Bearer token was obtained` — about the PACKAGE: check that `timothy/ersatztv` and its `ersatztv-ci` package are still PUBLIC |
+| 401 whose token leg yielded no bearer — no `Www-Authenticate` at all, a challenge naming no realm, or a token endpoint answering with no token | **red** | `could NOT OBTAIN an anonymous pull token` — about the registry's TOKEN ENDPOINT, not the package's visibility. Not retried |
+| 403 on the FIRST read, before any token leg — `probe` enters it on a `401` only, so nothing was ever asked for | **red** | `refused an ANONYMOUS read ... WITHOUT issuing a Bearer challenge` — about ACCESS to the registry: visibility, or something answering for it |
 | anything else (5xx, unreachable, no `curl`) | **red** after `ETV_CI_ATTEMPTS` tries | `could NOT VERIFY` — check the registry's health, NOT the pin |
 
 **The three refusal rows say only what actually ran**, and that is the point of wording them apart

scripts/ci-toolchain-image-resolves.sh

@@ -202,10 +202,10 @@ for pin in $pins; do
       #     contexts;
       #   * a challenge that yielded no usable token is an infrastructure answer about the TOKEN
       #     ENDPOINT;
-      #   * a refusal carrying NO Bearer challenge at all never reached the token leg — `probe`
-      #     enters it on a 401 only, so a first-read 403 (or a 401 with no `Www-Authenticate`, which
-      #     the token leg then abandons) leaves `token` empty having asked for nothing. This is an
-      #     answer about ACCESS to the registry, and the branch order below is `token` first
+      #   * a FIRST-READ 403 never reached the token leg at all — `probe` enters it on a 401 only —
+      #     so nothing was ever asked for. This is an answer about ACCESS to the registry. Note the
+      #     boundary: a 401 carrying no `Www-Authenticate` DOES enter the token leg and abandon it,
+      #     so it lands in the row above, not this one. The branch order below is `token` first
       #     precisely so this case cannot borrow either of the other two mechanisms.
       #
       # A failed token leg is NOT retried, deliberately: `token_leg_done` is set before the attempt