ci: fix ghcr push credential consistency

The GHCR push step used `||` between independent secrets:
`BOT_TOKEN || GITHUB_TOKEN` and `BOT_LOGIN || repository_owner`.
When only one `BOT_` secret was set, credentials became a mismatched
pair (e.g. BOT_TOKEN + repository_owner), causing a `denied: denied`
authentication failure from ghcr.io.

Now `&&` ensures both `BOT_TOKEN` and `BOT_LOGIN` must exist together
to be used; otherwise it falls back to the always-available and
consistent `GITHUB_TOKEN` + `github.actor` pair.

This is backwards-compatible: setups with both bot secrets keep working.
Setups with none or only one now consistently use GITHUB_TOKEN.

Author: yajo

.github/workflows/ci.yaml

@@ -101,6 +101,6 @@ jobs:
         if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
         env:
           REGISTRY_HOST: ghcr.io
-          REGISTRY_TOKEN: ${{ secrets.BOT_TOKEN || secrets.GITHUB_TOKEN }}
-          REGISTRY_USERNAME: ${{ secrets.BOT_LOGIN || github.repository_owner }}
+          REGISTRY_TOKEN: ${{ secrets.BOT_LOGIN && secrets.BOT_TOKEN || secrets.GITHUB_TOKEN }}
+          REGISTRY_USERNAME: ${{ secrets.BOT_TOKEN && secrets.BOT_LOGIN || github.actor }}
         run: ./hooks/push