The whole point of having protected runners is to do things that developers are not allowed to do. If any developer can push images to the registry without any review/approval, and those images are used in other CI pipeline that's a problem for us.

Having a separate production registry is good indeed, but for images to be used for CI itself, having something self-contained within gitlab would have been nice.