GHCR authentication is just broken. They still require the deprecated personal access tokens.
I was publishing public containers on Docker Hub, and I'm publishing public containers on GHCR.