ci: move container images to the org registry namespace

Build destination, both builder-image references and the three publish
pins now point at novoyuuparosk-wiki/*. The publish pins name a tag that
does not exist in the new namespace until this run's build job pushes it
and the pin job rewrites them, so publishes are briefly broken mid-run.

ci/Dockerfile.kaniko-act

@@ -5,10 +5,11 @@
 # (busybox lives under /busybox; /bin/sh is already symlinked) nor /tmp.
 # This wrapper adds exactly those two. Nothing else changes.
 #
-# Bootstrap: the first build of this image is done manually on the host
-# (docker build -f ci/Dockerfile.kaniko-act -t <registry>/mikkeli/kaniko-act:<ver> .)
-# because no builder image exists yet. Later version bumps can be built by
-# the build-image workflow itself, using the previous kaniko-act.
+# Bootstrap: the very first build of this image was done manually on the host
+# (docker build -f ci/Dockerfile.kaniko-act -t <registry>/<owner>/kaniko-act:<ver> .)
+# because no builder image existed yet. Version bumps are now built by
+# .gitea/workflows/build-kaniko-act.yml (dispatch-only), which runs in the
+# previous kaniko-act — confirmed working when the image moved to the org.
 FROM gcr.io/kaniko-project/executor:v1.23.2-debug
 SHELL ["/busybox/sh", "-c"]
 RUN ln -sf /busybox/sleep /bin/sleep && mkdir -p -m 1777 /tmp