[JustMaris]

Extends docker-publish.yml so the two private image builds can use it: slovy-py (2 Dockerfiles, built on PRs without pushing) and Mystery-Game (2 targets of one Dockerfile), both on oracle-x64.

• New inputs: file, target, push (default true; false builds without pushing or attesting).
• On a self-hosted runner, set automatically:
  • driver: docker, so the layer cache stays on the VM
  • provenance: false, because dockerd's builder can't store buildx's provenance manifest
  • the same capped cleanup the callers run today (buildx prune --max-used-space 20GB)
• Private repos: the attestation step is skipped, since artifact attestations need GitHub Enterprise Cloud for private repositories.
• Existing callers: hosted, public, defaults. They behave exactly as before.
• The README documents the new inputs, the one-platform limit of the self-hosted builder, and that callers still grant the full permission set.

actionlint and zizmor (offline) are clean locally.