CI: use REGISTRY_TOKEN secret for registry login

The auto Actions token can't push packages in this Gitea; use a PAT secret.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -34,13 +34,10 @@ jobs:
     runs-on: docker
     steps:
       - uses: actions/checkout@v4
-      # Auth to the Gitea container registry. The auto-provisioned job token
-      # works for the repo owner's package namespace in the common config; if a
-      # run ever fails here with a permissions error, add a repo Actions secret
-      # REGISTRY_TOKEN (a PAT with write:package) and swap secrets.GITHUB_TOKEN
-      # for secrets.REGISTRY_TOKEN below.
+      # The auto-provisioned Actions token cannot push packages in this Gitea,
+      # so use a PAT (write:package) stored as the REGISTRY_TOKEN repo secret.
       - name: Log in to registry
-        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login git.jpaul.io -u "${{ github.actor }}" --password-stdin
+        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.jpaul.io -u "${{ github.actor }}" --password-stdin
       - name: Build + push
         run: |
           docker build -t "$IMAGE:latest" -t "$IMAGE:${{ github.sha }}" .