Remove OS titlebar and add custom window chrome - #29

* origin/main:
  Plumb desktop profile identity UI (#32)
  Add unread indicators to desktop channels (#31)
  feat: public profiles, NIP-05 identity, search & presence tools (#28)
  Add desktop settings page (#30)
  Remove OS titlebar and add custom window chrome (#29)

# Conflicts:
#	TESTING.md
#	crates/sprout-mcp/src/server.rs
#	crates/sprout-test-client/tests/e2e_mcp.rs

…pace

Both "Build public push gateway" jobs built successfully and then failed
on the very last step:

  block#29 ERROR: error writing layer blob: denied: permission_denied:
  The requested installation does not exist.

The image push is already correctly gated (`push=${{ github.event_name !=
'pull_request' }}`), but `cache-to` was hardcoded to
`ghcr.io/block/buzz-push-gateway-buildcache`. The GHCR login step
authenticates as `github.repository_owner` with the run's `GITHUB_TOKEN`,
so inside this fork that token can write `ghcr.io/intent-solutions-io/*`
and never `ghcr.io/block/*`. The existing guard only asks "is this a
same-repo PR rather than a fork PR" -- true here, since the branch lives
in intent-solutions-io/buzz -- so the export was attempted and denied.

Derived the buildcache ref from `github.repository_owner` so each org
writes the namespace it owns, and made `cache-from` read the org's own
cache first with block's public cache as fallback, so a fork's first
build is still warm. Upstream behaviour is unchanged: on block/buzz both
cache-from entries and the cache-to ref resolve to the same
`ghcr.io/block/...` value they did before.

Chose owner-derived cache refs over simply disabling the export on forks
because disabling it would leave every fork build uncached, and this
matches how the relay job in the same file already behaves (it routes
through the `IMAGE_NAME` / `vars.GHCR_IMAGE` override, which is why relay
builds pass here while only the gateway failed). Deliberately did NOT
touch the published image name or the `outputs:` line -- that would change
artifact identity upstream, which this PR has no business doing.

Verified: docker.yml parses as YAML and `actionlint docker.yml` is clean.
The export path itself can only be exercised by a real run, so this is
confirmed by CI on push, not locally.

Signed-off-by: jeremylongshore <jeremylongshore@users.noreply.github.com>