ci: push canonical image to ghcr.io/bootnode/bootnode

Add BOOTNODE_GHCR_PAT secret-based login to push API and web images
to the canonical ghcr.io/bootnode/bootnode registry in addition to
ghcr.io/hanzoai/bootnode. Also add provenance=false/sbom=false to web
build to avoid attestation timeouts on linux/amd64.

.github/workflows/ci.yml

@@ -9,6 +9,7 @@ on:
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME: hanzoai/bootnode
+  CANONICAL_IMAGE: bootnode/bootnode
 
 jobs:
   test-api:
@@ -166,13 +167,20 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Log in to Container Registry
+      - name: Log in to Container Registry (hanzoai)
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Log in to Container Registry (bootnode org)
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.BOOTNODE_GHCR_PAT }}
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -191,6 +199,8 @@ jobs:
           tags: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:api-latest
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:api-${{ steps.sha.outputs.short }}
+            ${{ env.REGISTRY }}/${{ env.CANONICAL_IMAGE }}:api-latest
+            ${{ env.REGISTRY }}/${{ env.CANONICAL_IMAGE }}:api-${{ steps.sha.outputs.short }}
           cache-from: type=gha,scope=api
           cache-to: type=gha,mode=max,scope=api
 
@@ -199,9 +209,14 @@ jobs:
         with:
           context: ./web
           push: true
+          platforms: linux/amd64
+          provenance: false
+          sbom: false
           tags: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:web-latest
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:web-${{ steps.sha.outputs.short }}
+            ${{ env.REGISTRY }}/${{ env.CANONICAL_IMAGE }}:web-latest
+            ${{ env.REGISTRY }}/${{ env.CANONICAL_IMAGE }}:web-${{ steps.sha.outputs.short }}
           cache-from: type=gha,scope=web
           cache-to: type=gha,mode=max,scope=web