Use the built-in GITEA_TOKEN instead of a hand-made RELEASE_TOKEN secret

Gitea injects a token into every Actions job as secrets.GITEA_TOKEN, so the
manually created PAT was never necessary. Declare permissions: contents:
write on the job, which Gitea maps to Code: write (deleting the latest-main
tag) and Releases: write (creating the release, uploading the asset) - the
full set the publish step needs.

Removes a secret that had to be created by hand, could expire, and was a
single point of failure the workflow had no fallback for.

.gitea/workflows/build-main.yml

@@ -10,6 +10,11 @@ on:
 jobs:
   package:
     runs-on: gitea-runner-server03
+    # contents: write maps to Code: write (deleting the latest-main tag) plus
+    # Releases: write (creating releases and uploading the asset) - everything
+    # the publish step below needs, so it runs on the built-in GITEA_TOKEN.
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@v7
 
@@ -30,7 +35,7 @@ jobs:
         env:
           GITEA_API: ${{ gitea.server_url }}/api/v1
           REPO: ${{ gitea.repository }}
-          TOKEN: ${{ secrets.RELEASE_TOKEN }}
+          TOKEN: ${{ secrets.GITEA_TOKEN }}
           SHA: ${{ gitea.sha }}
           REF: ${{ gitea.ref }}
         run: |