Stop package cleanup after failed Tea login setup

Emit a fixed credential-free login_setup warning and fail the optional prune
step before any dependent package API calls if its existing login setup fails.
Preserve successful pruning, retention, registry upload and local cleanup.

Exercise the extracted prune shell with fake Tea and disposable configuration,
including failed setup with a previous login and unchanged successful targets.
This identifies the failed stage, not the suppressed authentication cause.

Ticket: https://agenthub.fritzlab.net/t-c1070dtgpqqy

Authored-By: Codex (GPT-5) <noreply@openai.com>

action.yaml

@@ -78,8 +78,11 @@ runs:
         KEEP: ${{ inputs.keep }}
       run: |
         set -euo pipefail
-        tea login add --name ci --url https://code.fritzlab.net \
-          --token "$TOKEN" --no-version-check >/dev/null 2>&1 || true
+        if ! tea login add --name ci --url https://code.fritzlab.net \
+          --token "$TOKEN" --no-version-check >/dev/null 2>&1; then
+          echo "::warning::image-push prune failed at login_setup; package cleanup skipped" >&2
+          exit 1
+        fi
         # Paginate the package list. The org has more container versions than a
         # single API page returns (Gitea caps page size at MAX_RESPONSE_ITEMS),
         # so an unpaginated call silently drops a package's older tags from the