Re-running the helper hit Gitea 400 'token name has been used' because the
token name was only date-stamped. Add time+pid to make names unique, surface
the real HTTP status/body, and continue past a single token failure.
The auto GITEA_TOKEN has no package-registry scope, so docker login to
gitea.leeworks.dev returned 'unauthorized'. Use a dedicated PAT (REGISTRY_TOKEN,
write:package) with the token-owner username. Helper script now mints both
SIBLING_REPOS_TOKEN and REGISTRY_TOKEN from one password prompt.