[Bug]: container image push fails with 401 on manifest PUT to ECR; pull from same registry succeeds

### I have done the following

- [x] I have searched the existing issues
- [x] If possible, I've reproduced the issue using the 'main' branch of this project

### Steps to reproduce

```sh
# Login
aws ecr get-login-password --region \
| container registry login --username AWS --password-stdin \
.dkr.ecr..amazonaws.com

# Pull works fine
container image pull .dkr.ecr..amazonaws.com/:

# Push fails on manifest
container image push .dkr.ecr..amazonaws.com/:
```

### Current behavior

Blob uploads succeed (100%), then the manifest PUT returns 401:

```
Error: HTTP request to https://.dkr.ecr..amazonaws.com/v2//manifests/ failed with response: 401 Unauthorized. Reason: invalidArgument: "missing Bearer challenge in WWW-Authenticate header"
```

### Expected behavior

Manifest pushes successfully after blobs, consistent with how pull works.

### Key observations

- `container image pull` from the same registry with the same credentials **succeeds**
- Blob uploads during push succeed (100%); only the final manifest PUT fails
- The error is consistent and reproducible
- This isolates the bug to the manifest PUT authentication path in `container image push`, not to credential storage or blob handling

### Environment

```markdown
- OS: macOS 26.5.1
- Container: CLI version 1.0.0 (build: release, commit: ee848e3) — signed installer from GitHub releases
- Registry: AWS ECR
```

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct

Start by reproducing the failure against AWS ECR, then trace the manifest PUT authentication path in `container image push` and compare it with the successful pull and blob-upload paths. Done means the manifest PUT succeeds with the documented ECR credentials while preserving the existing successful pull and blob-upload behavior.

Written by the indexing model from the issue text.