restore previous fixes with renamed token property

.gitea/workflows/build.yml

@@ -10,18 +10,18 @@ name: Build
 # This project's CI/CD scope is intentionally just test/build/push --
 # deployment is being split into a separate project.
 #
-# Requires secrets.GITEA_TOKEN (auto-injected by Gitea Actions; needs the
-# "packages" permission scope to push images).
+# Requires secrets.BUILD_API_TOKEN -- a personal access token
+# (write:package scope) from the pushing account, stored manually as a repo
+# secret. The auto-injected secrets.GITEA_TOKEN does NOT work for this: it
+# never grants package-registry access regardless of the workflow's own
+# `permissions:` block -- a known Gitea limitation, not a config mistake
+# (https://github.com/go-gitea/gitea/issues/23642).
 
 on:
   push:
     branches: [main]
   workflow_dispatch:
 
-permissions:
-  contents: read
-  packages: write
-
 jobs:
   build-and-push:
     runs-on: ubuntu-latest
@@ -41,7 +41,9 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Log in to the container registry
-        run: echo "${{ secrets.GITEA_TOKEN }}" | docker login code.aneur.in -u "${{ gitea.actor }}" --password-stdin
+        env:
+          BUILD_API_TOKEN: ${{ secrets.BUILD_API_TOKEN }}
+        run: echo "$BUILD_API_TOKEN" | docker login code.aneur.in -u "${{ gitea.actor }}" --password-stdin
 
       - name: Promote the current "latest" to "previous"
         run: |