Stop optional image pruning after failed Tea login setup

Guard failed cleanup login setup before dependent package operations; preserve successful and optional cleanup semantics. Required contract CI 20382 passed. Exact task-specific Human review-count exception is recorded on t-c1070dtgpqqy; official architect review 8504 approved this head. No authentication repair, tag movement or consumer activation.

Authored-By: Codex (GPT-5) <noreply@openai.com>

README.md

@@ -43,6 +43,13 @@ local Docker daemon, image-push uploads it.
    delete the rest. Failures here do not fail the workflow
    (`continue-on-error: true`).
 
+Cleanup first sets up its existing Tea login. If that setup fails, the optional
+prune step exits with a fixed `login_setup` warning and does not list or delete
+packages, even if a previous login is available. Login output remains suppressed
+to avoid exposing credentials or configuration. This identifies the failing
+stage, not the underlying authentication or configuration cause; it does not
+repair login setup or change the successful cleanup's targets or retention.
+
 `prune` accepts only the strings `true` and `false`; invalid input fails before
 registry login or push. With `false`, remote package listing and deletion are
 skipped. Image upload and local Docker cleanup remain unchanged. The action does
@@ -50,5 +57,7 @@ not discover deployment pins; owners choosing pruning must account for that
 retention contract.
 
 Run `python3 -m unittest discover -s tests` with the pinned test dependencies in
-`tests/requirements.txt`. Tests inspect the composite action and execute only
-its credential-free validation step; no registry or package deletion runs.
+`tests/requirements.txt`. Tests inspect the composite action, execute its
+credential-free validation step, and exercise the prune shell with a fake Tea
+client and disposable configuration. No real login, registry operation, or
+package deletion runs.