feat: update submission workflow to include Docker Hub credentials configuration and security guidelines

Author: abdibekbolot

docs/miner/workflow/4.submit-commit.md

@@ -65,7 +65,37 @@ For example:
     - Only one commit per challenge is allowed in the `active_commit.yaml` file. If you add multiple commits for the same challenge, only the last one will be considered during submission and others will be ignored.
     - We are allowing only one commit per challenge/day for submission to avoid spam, abuse, unnecessary network load, and fair evaluation for all participants.
 
-## 4.3. Configure environment variables
+## 4.3. Configure Docker Hub credentials
+
+Your miner needs Docker Hub credentials to pull your private images during validation. See the [Docker Hub Registry & PAT guide](../concepts/dockerhubpat.md) for full details — here is a summary of what to prepare:
+
+!!! warning "One Username Policy"
+    All images in your `active_commit.yaml` must use a **single Docker Hub username**. Mixing usernames (e.g. `alice/solver` and `bob/detector`) will cause authentication failures because only one set of credentials is used for pulling.
+
+**Before continuing, make sure you have:**
+
+1. **A private Docker Hub repository** — public repos expose your solution to competitors. Go to your repo **Settings → Visibility → Private**.
+2. **A Personal Access Token (PAT)** with **Read-only** scope — never use your account password. Generate one at [hub.docker.com/settings/security](https://hub.docker.com/settings/security).
+3. **Verified the token works** locally:
+
+    ```bash
+    echo "<your-pat>" | docker login -u <your-username> --password-stdin
+    # Expected output: Login Succeeded
+    ```
+
+These values go into your `.env` file in the next step:
+
+| `.env` variable | Value |
+|---|---|
+| `DOCKER_HUB_USERNAME` | Your Docker Hub username |
+| `DOCKER_HUB_PAT` | The Read-only PAT you generated |
+
+!!! danger "Never commit your PAT"
+    Add `.env` to your `.gitignore`. If you accidentally expose a PAT, revoke it immediately from the [security settings page](https://hub.docker.com/settings/security) and generate a new one.
+
+---
+
+## 4.4. Configure environment variables
 
 - You need [Bittensor wallet that registered](../../manuals/bittensor/wallet/register.md) on RedTeam Subnet 61.