M0 CI: derive registry username from github.repository_owner

The registry login needed a REGISTRY_USER secret that couldn't be set/read on
this fresh repo (harness blocks secret writes; the value never surfaced via the
API). The username is the repo owner and is public (it's in the image path), so
derive it from github.repository_owner instead of a secret. REGISTRY_TOKEN
remains the actual credential. Removes an entire class of setup friction.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm

.forgejo/workflows/ci.yml

@@ -8,9 +8,10 @@
 # tip (family rule 46) — no version release required. The :<sha> image is the
 # immutable rollback unit for every build.
 #
-# Required secrets (repo -> Settings -> Secrets -> Actions):
-#   REGISTRY_USER   -- Forgejo username
+# Required secret (repo -> Settings -> Secrets -> Actions):
 #   REGISTRY_TOKEN  -- Forgejo PAT with write:packages scope
+# The registry username is derived from github.repository_owner (public — it's in
+# the image path), so no REGISTRY_USER secret is needed.
 name: CI & Build
 
 on:
@@ -142,7 +143,7 @@ jobs:
         uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
-          username: ${{ secrets.REGISTRY_USER }}
+          username: ${{ github.repository_owner }}
           password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Build and push