[lenny] fix(ci): fork-scoped GHCR images + product/main CI qualification for docker workflow

[mfethe1]

What

• Push-gateway image refs hardcoded to ghcr.io/block/buzz-push-gateway → fork builds fail with permission_denied on layer push
• qualify gate only accepted CI runs from main/release → tag builds from product/main commits timed out 65 min then failed
• staging-dev-relay-image.yml is hard-restricted to block/buzz via repos: condition

Changes

• All push-gateway image refs → ghcr.io/${{ github.repository_owner }}/buzz-push-gateway
• qualify jq also accepts product/main push runs
• Restores select(.status != "completed") on pending (lost in edit)

Evidence

• Tag run 34560747265: Build (amd64/arm64) SUCCESS, gateway jobs FAILED on upstream registry deny (logs above)
• GHCR_IMAGE repo variable set to ghcr.io/mfethe1/buzz before this build
• This PR's checks will re-run docker workflow against fork-scoped registry

Path B (CI config is a sensitive path).

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 1b43df21-03e3-4bdb-a3f4-7f7e3e534ebf

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[mfethe1]

Holding this one — there is a typo in the cache-to expression that would silently disable the build cache.

github.pull_request.head.repo.full_name

should be

github.event.pull_request.head.repo.full_name

The github context has no pull_request key; the pull request payload lives under github.event. GitHub Actions resolves an unknown context property to an empty string rather than erroring, so the && short-circuits to '' on every run, cache-to is always empty, and every Docker build repopulates from scratch. The workflow stays green, which is exactly why this would not get caught.

Note the same file already uses the correct form at the line above (github.event_name != 'pull_request'), and the buzz-push-gateway cache-to block retains github.event.pull_request... — so this is an isolated slip in one branch of one ternary, not a pattern.

The rest of the PR is good: github.repository_owner for GHCR images and the product/main qualification branch are both correct and needed now that #38 has landed and the trunk actually produces push runs. Fix that one expression and I will merge.