Built-in job token (secrets.GITHUB_TOKEN) returns 401 against the
Package Registry API on this Gitea instance even with
permissions: packages: write, so use a manual PACKAGE_TOKEN secret
instead.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>