docker pull fails with "could not fetch content descriptor" for existing image

I'm trying to use atcr.io/tangled.org/knot:v1.13.0-alpha (and latest) in a self-hosted server context. The image appears to exist — the registry web UI shows it with 107 pulls — but docker pull consistently fails.

Steps to reproduce

# Login (works fine)
$ docker login atcr.io -u olamaelcu.net
Password:
Login Succeeded
# Pull fails
$ docker pull atcr.io/tangled.org/knot:v1.13.0-alpha
Error response from daemon: could not fetch content descriptor sha256:5672498fc6ae... not found
The same happens with latest:
$ docker pull atcr.io/tangled.org/knot:latest
Error response from daemon: could not fetch content descriptor sha256:0d1b2c3... not found

What I've tried

1. Anonymous pull — Same error before login
2. Login with ATProto app password — docker login atcr.io -u with an app password works (Login Succeeded), but pull still fails with the same error
3. Using the docker-credential-atcr helper — Installed v0.1.2 from releases, configured ~/.docker/config.json with {"credHelpers": {"atcr.io": "atcr"}}. The helper appears to authenticate (no error), but the pull still fails with the same content descriptor error
4. Different network contexts — Same failure from my local machine and from the server (134.209.125.162 for reference in logs)
5. Explicitly specifying the platform (--platform linux/amd64) — No difference

Environment

• Docker version: 27.x (both local and server)
• OS: Debian (server), Debian (local)
• docker-credential-atcr version: v0.1.2

Observations

• The registry web UI at https://atcr.io/tangled.org/knot shows the image and tag exists (107 pulls for v1.13.0-alpha and latest)
• The content descriptor hash in the error (sha256:5672498fc6ae...) does not appear to match any content when inspected via the web UI