fix(ci): secure existing Docker authentication directories

.gitea/workflows/ci.yml

@@ -95,7 +95,8 @@ jobs:
           GITEA_RELEASE_TOKEN: ${{ secrets.RAWMARK_GITEA_TOKEN }}
         run: |
           set -eu
-          mkdir -m 700 "$DOCKER_CONFIG"
+          mkdir -p "$DOCKER_CONFIG"
+          chmod 700 "$DOCKER_CONFIG"
           python3 scripts/release.py promote-development "$TEMP_IMAGE"
       - name: Clean only this attempt's resources and credentials
         if: always()
@@ -131,7 +132,8 @@ jobs:
       - name: Deploy only the independent development instance
         run: |
           set -eu
-          mkdir -m 700 "$DOCKER_CONFIG"
+          mkdir -p "$DOCKER_CONFIG"
+          chmod 700 "$DOCKER_CONFIG"
           printf '%s' "$GITEA_RELEASE_TOKEN" | docker login git.134333.xyz --username eezd --password-stdin
           python3 scripts/deploy.py development --directory /docker/main/rawmark-dev \
             --image "$DEPLOY_IMAGE" --commit "$DEPLOY_COMMIT" --version "$DEPLOY_VERSION" \

.gitea/workflows/deploy-production.yml

@@ -41,7 +41,8 @@ jobs:
       - name: Verify completed release, back up and deploy only RawMark
         run: |
           set -eu
-          mkdir -m 700 "$DOCKER_CONFIG"
+          mkdir -p "$DOCKER_CONFIG"
+          chmod 700 "$DOCKER_CONFIG"
           python3 scripts/deploy.py production --directory /docker/main/rawmark \
             --version "$RELEASE_VERSION" --client-container "$(hostname)"
       - name: Remove job configuration

.gitea/workflows/release.yml

@@ -142,7 +142,8 @@ jobs:
       - name: Publish the original checked artifacts to both services
         run: |
           set -eu
-          mkdir -m 700 "$DOCKER_CONFIG"
+          mkdir -p "$DOCKER_CONFIG"
+          chmod 700 "$DOCKER_CONFIG"
           python3 scripts/release.py publish
       - name: Clean only this attempt's test resources and credentials
         if: always()