The whole point of having protected runners is to do things that developers are not allowed to do. If any developer can push images to the registry without any

The whole point of having protected runners is to do things that developers are not allowed to do. If any developer can push images to the registry without any review/approval, and those images are used in other CI pipeline that's a problem for us. Having a separate production registry is good indeed, but for images to be used for CI itself, having something self-contained within gitlab would have been nice.