fix(ci): publish container under token account namespace

scripts/publish-container.sh

@@ -11,6 +11,12 @@ registry="${registry%/}"
 [[ "$REGISTRY_SERVER" = https://* && "$registry" != */* ]] || { echo "Registry must use HTTPS at the Gitea server root" >&2; exit 1; }
 repository="${REGISTRY_REPOSITORY,,}"
 [[ "$repository" =~ ^[a-z0-9._-]+/[a-z0-9._-]+$ ]] || exit 1
+# Gitea packages belong to a user/organization, independently of repository ACLs.
+# A collaborator token cannot publish to another user's personal namespace.
+namespace="${REGISTRY_NAMESPACE:-$REGISTRY_USER}"
+namespace="${namespace,,}"
+[[ "$namespace" =~ ^[a-z0-9][a-z0-9._-]*$ ]] || { echo "Invalid registry namespace; use a Gitea username or organization" >&2; exit 1; }
+repository="$namespace/${repository#*/}"
 image="$registry/$repository:$sha"
 # Isolate credentials from the self-hosted runner's normal Docker configuration.
 export DOCKER_CONFIG