Publish releases within the organization only

[ru-sh]

CI still published this fork to upstream's channels, and the release jobs built
from upstream's artifacts. This keeps everything inside the organization.

Removed

• npm — published to registry.npmjs.org as the unscoped code-server
  with NPM_TOKEN.
• AUR — force-pushed cdrci/code-server-aur and opened a PR on
  coder/code-server-aur.
• Docker Hub — pushed docker.io/codercom/code-server alongside
  ghcr.io/coder/code-server.
• codecov — uploaded coverage to a third party; .github/codecov.yml goes
  with it.
• Helm-chart and Code-update PRs opened against coder/code-server; the
  cdrci / opensource@coder.com identity; the announcement discussion in the
  release workflow, which is an upstream convention and fails where Discussions
  are not enabled.
• publish:npm, which pointed at a ci/steps/publish-npm.sh that does not
  exist.

Worth a look

Both publish jobs downloaded their release assets from coder/code-server
rather than this repository, so publishing would have shipped upstream's build
under this organization's name, without the patches this fork carries. They now
read this repository's own release.

Added

• The image is published to ghcr.io/motuslabs/code-server, derived from
  $GITHUB_REPOSITORY so it follows the repo rather than being hardcoded.
  DOCKER_REGISTRY now defaults to empty in docker-bake.hcl, and gen_tags
  generates nothing for an empty registry, so a Docker Hub tag cannot be
  produced by accident.
• install.sh takes its source repository from a single REPO variable
  defaulting to MotusLabs/code-server, the Docker build reads this
  repository's release, and the Helm chart points at the GHCR image. Package
  metadata in the published .deb/.rpm and the built app's reportIssueUrl
  name this organization.
• The nightly Trivy scan now scans the image this organization publishes
  instead of upstream's Docker Hub image.
• docs/MAINTAINING.md, docs/install.md and docs/helm.md updated, including
  the docker login ghcr.io step consumers need.

Follow-ups not in this PR

• src/node/routes/index.ts:62 still checks
  api.github.com/repos/coder/code-server/releases/latest for updates, so
  deployments are told about upstream's releases. Product code, not CI.
• ci/build/nfpm.yaml still names an upstream maintainer in every package;
  needs a real contact address.
• install.sh npm/brew/AUR paths (Alpine, FreeBSD, Arch, macOS with brew, and
  every i386 fallback) still install upstream's build. Removing them means
  rewriting the bats tests.
• .github/CODEOWNERS assigns * @coder/code-server, a team that does not
  exist here, so reviewer assignment fails silently.

Repo secrets now unused: NPM_TOKEN, DOCKER_USERNAME, DOCKER_PASSWORD,
HOMEBREW_GITHUB_API_TOKEN, CODECOV_TOKEN.

Testing

actionlint, shellcheck (npm run lint:scripts), prettier --check and the
34 bats script tests all pass; doctoc regenerated with no drift.