ci: make image namespaces fork-neutral

[RossHartmann]

Summary

• default relay and push-gateway image names to the current repository owner
• allow each image namespace to be overridden independently with repository variables
• keep cache publication, attestations, summaries, and verification commands on the same selected namespace

Why

The relay workflow already offered a partial override, but the default and all push-gateway paths were pinned to block. A protected main build in a fork could therefore compile successfully while publishing or attesting against a namespace it does not own.

Validation

• parsed .github/workflows/docker.yml with PyYAML and asserted all four image jobs are present
• asserted the owner-derived relay/gateway defaults and dynamic digest/provenance paths
• asserted no hard-coded ghcr.io/block/buzz-push-gateway reference remains
• git diff --check

The commit is signed off under the DCO.