Am I correct that if I have a base pants.toml file, and additional pants.ci.toml (set via environmental variable PANTS_CONFIG_FILES), the will both be used, but configs in pants.ci.toml will take precedence?

I think it depends on the order you specify the files in the env var. It is easy to confirm thoughj by running

pants help ..

for a subsystem you care about to see the effective value picked up for the options.

Thanks this helped. It confirmed that by using the environmental option it maintains what is in pants.toml, but overrides what I need (docker.registry.something).