ci(ghcr): publish the CI image to the org namespace

The CI image has not published since 2026-05-04. Every run since fails at
the push:

    #9 pushing ghcr.io/ten9876/aethersdr-ci:latest with docker
    #9 ERROR: denied: permission_denied: The requested installation does
       not exist.

The build itself is fine — all layers complete, and the Dockerfile builds
clean locally. The failure is purely one of namespace. This repository is
owned by the `aethersdr` org, so `secrets.GITHUB_TOKEN` is scoped to
`aethersdr/AetherSDR`; the package lives in the personal `ten9876`
namespace, which that token has no write access to. `packages: write` in
the workflow grants nothing outside the token's own namespace.

This was not a regression from any Dockerfile change. #4656 adding
`ccache` was simply the first Dockerfile push after the access broke,
which is why it looked like the culprit.

Move the package to `ghcr.io/aethersdr/aethersdr-ci`, alongside the
repository that builds it, so the default token can publish it and the
image cannot be orphaned again by an ownership change.

The digest-pin step's regex now matches either owner and always rewrites
to the org path, so a consumer left on the old namespace by a long-lived
branch is normalised rather than pinned to a digest under a namespace
this token cannot publish to.

Sequencing note: consumers move in this same commit, so the org package
must exist and be PUBLIC before this merges. `workflow_dispatch` runs the
workflow as defined on the chosen ref, so dispatching docker-ci-image.yml
on this branch publishes the org image first; the package then has to be
flipped to public by hand, because GHCR creates new packages private and
the `container:` jobs pull unauthenticated — the current ten9876 package
is public, which is why no `credentials:` block was ever needed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: ten9876

.github/workflows/ci.yml

@@ -30,7 +30,7 @@ permissions:
 jobs:
   build:
     runs-on: ubuntu-latest
-    container: ghcr.io/ten9876/aethersdr-ci:latest
+    container: ghcr.io/aethersdr/aethersdr-ci:latest
 
     # Explicit CCACHE_DIR: the job runs as root inside a container, so `~`
     # resolves to /root and an actions/cache `path:` of `~/.cache/ccache` would

.github/workflows/codeql.yml

@@ -69,7 +69,7 @@ permissions:
 jobs:
   analyze:
     runs-on: ubuntu-latest
-    container: ghcr.io/ten9876/aethersdr-ci:latest
+    container: ghcr.io/aethersdr/aethersdr-ci:latest
 
     strategy:
       matrix:

.github/workflows/docker-ci-image.yml

@@ -41,7 +41,7 @@ jobs:
         with:
           context: .github/docker
           push: true
-          tags: ghcr.io/ten9876/aethersdr-ci:latest
+          tags: ghcr.io/aethersdr/aethersdr-ci:latest
 
       - name: Update workflow consumers to new digest
         id: pin
@@ -58,12 +58,18 @@ jobs:
           # run swaps the legacy ":latest" reference cleanly.
           # The `[ -f ]` guard lets the loop run cleanly even if a consumer
           # file isn't on main yet (e.g. sanitizers.yml until PR #2866 lands).
+          #
+          # The owner alternation matches the pre-move `ten9876` namespace as
+          # well as the current `aethersdr` one, and always rewrites to the
+          # latter. That way a consumer left on the old namespace by a
+          # long-lived branch is normalised rather than pinned to a digest
+          # under a namespace this token cannot publish to.
           for f in .github/workflows/ci.yml \
                    .github/workflows/codeql.yml \
                    .github/workflows/sanitizers.yml; do
             [ -f "$f" ] || continue
             sed -i -E \
-              "s#(ghcr\.io/ten9876/aethersdr-ci)(@sha256:[a-f0-9]+|:[A-Za-z0-9._-]+)#\1@${DIGEST}#g" \
+              "s#ghcr\.io/(ten9876|aethersdr)/aethersdr-ci(@sha256:[a-f0-9]+|:[A-Za-z0-9._-]+)#ghcr.io/aethersdr/aethersdr-ci@${DIGEST}#g" \
               "$f"
           done
           echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
@@ -83,7 +89,7 @@ jobs:
             publishing a new CI image from the current
             `.github/docker/Dockerfile`.
 
-            Updates the `ghcr.io/ten9876/aethersdr-ci` reference in
+            Updates the `ghcr.io/aethersdr/aethersdr-ci` reference in
             `ci.yml`, `codeql.yml`, and `sanitizers.yml` (where present) to:
 
                 ${{ steps.pin.outputs.digest }}

.github/workflows/sanitizers.yml

@@ -19,7 +19,7 @@ jobs:
   sanitize:
     name: ${{ matrix.sanitizer.label }}
     runs-on: ubuntu-latest
-    container: ghcr.io/ten9876/aethersdr-ci:latest
+    container: ghcr.io/aethersdr/aethersdr-ci:latest
     strategy:
       fail-fast: false
       matrix: