run: update GUNICORN_OPTS and REGISTRY_TLS_VERIFY to match upstream contract