- Replace type=gha cache (disabled on this runner) with type=registry cache
- Upgrade docker/build-push-action v5 → v6 (matches whisper-rtx2080 pattern)
- Switch auth to REGISTRY_USERNAME/REGISTRY_TOKEN repo secrets
- Split into two parallel jobs (build-cpu / build-gpu) for visibility
- Use github.ref conditions (Gitea compat) instead of is_default_branch