The auto-injected secrets.GITEA_TOKEN doesn't work for pushing to
Gitea's container registry regardless of the workflow's own
permissions: block -- a known Gitea limitation, not a config mistake
(go-gitea/gitea#23642). Switch to a manually-configured
CONTAINER_REGISTRY_PASSWORD secret (a personal access token with
write:package scope) instead.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>