docs(skill): cover registry pulls and Void proof

skills/apsuflow/SKILL.md

@@ -48,7 +48,9 @@ in the same change when applicable requirements or CLI behavior change.
   must prove its unprivileged effective UID and create/remove a child beneath a
   writable delegated cgroup v2 path exposing `cpu`, `memory`, and `pids`.
   `doctor` reports the same kernel-observed parent-process and cgroup facts.
-  Failure is closed: there is no root or service-manager-specific fallback.
+  Failure is closed: there is no root or service-manager-specific fallback. The
+  current runit profile also passed its complete acceptance path on Void Linux
+  musl; that is evidence for the capability contract, not a distro special case.
 - `.apsu` contains desired workloads and infrastructure, never secret values or
   mutable runtime state.
 - Services are continuously reconciled. Jobs are finite run-to-completion work.
@@ -77,6 +79,13 @@ Use only the exact stable tag and artifact named by `docs/getting-started.md`.
 Verify `SHA256SUMS` and its SSH signature before installing; never use a mutable
 `latest` URL. Keep the previous executable and state backup until the new one
 passes `version`, `doctor`, workload diagnosis, and each operator-facing route.
+For a private image registry, pipe the credential into `apsuflow registry login
+<host> --username <user> --password-stdin`; do not put it in `.apsu` or shell
+history. Login stores sealed `_registry/{host}` state, and joined agents receive
+only their per-node-resealed pull credential during assignment. Confirm the next
+pull succeeds; `unauthorized` means the registry host or credential is wrong, not
+that the workload should be stopped first.
+
 For host-network workloads, confirm the old container released its host ports and
 the successor is the sole running generation; repeated replacement failures are
 a rollback signal, not a reason to mutate runtime state directly. The first