The auto-injected secrets.GITEA_TOKEN doesn't work for pushing to
Gitea's container registry regardless of the workflow's own
permissions: block -- a known Gitea limitation, not a config mistake
(go-gitea/gitea#23642). Switch to a manually-configured
CONTAINER_REGISTRY_PASSWORD secret (a personal access token with
write:package scope) instead.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Builds and pushes to Gitea's container registry on push to main
("latest"/"previous", to avoid accumulating per-commit tags) and on
git tag push (tagged to match). Deployment is intentionally out of
scope here -- that work is being split into a separate project.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>