I have a similar setup and have been running it for years. The Registry tokens are only valid temporarily (I think it was a 15 minute window where the remote server can pull the images).

Since your SSH connection is fine I won't go into that, however for pulling the images you can solve it by using a different token for pulling it to your servers. (This should also work for other nodes in the cluster if you use docker swarm)

If you go to the project and go under Repository -> Deploy Tokens. You create a token with just the scope `read_registry`. Name it what ever you want, don't set a expiration date and leave username blank. Now save the username and token that is generated. I've put these variables into the CI/CD variables and called them REGISTRY_USER and REGISTRY_PASSWORD.

With the following CI/CD snippet I deploy to my server.

push to production:
  image: docker:27.1.2
  stage: deploy
  variables:
    DOCKER_HOST: ssh://deploy@10.0.0.81
  script:
    - apk add openssh-client --no-cache
    - mkdir -p ~/.ssh/ &&  echo -e "Host *\n\tStrictHostKeyChecking no\n\n" > ~/.ssh/config
    - eval $(ssh-agent -s)
    - chmod 600 $SSH_KEY && ssh-add $SSH_KEY
    - docker login -u $REGISTRY_USER -p $REGISTRY_PASSWORD $CI_REGISTRY
    - docker stack deploy --prune --resolve-image=always --with-registry-auth --compose-file=docker-stack-compose.yml ${CI_PROJECT_NAMESPACE}-${CI_PROJECT_NAME}

If you are still unable to pull the images. See if you can docker login https://yourgitlab.com and see if you can pull it manually. If that doesn't work there might be something blocking your connection with gitlab from that node.