A rootless container client logs in successfully and image pulls still fail

Authentication is fine, yet rootless resolution walks through an alias path the user-level trust bundle does not recognize.