Read the release token from RELEASE_TOKEN

The publish step set GITEA_TOKEN from the org-level API_TOKEN secret, but
the Actions runner injects its own GITEA_TOKEN into every step and that
value overrides a step-level env: entry of the same name. The org secret
was silently ignored and the job failed.

Pass the secret as RELEASE_TOKEN instead, which the runner does not
reserve, and read that name in release.py. --token-env makes the source
configurable, so the runner-provided GITEA_TOKEN can still be used
deliberately by passing --token-env GITEA_TOKEN.

.gitea/workflows/release.yml

@@ -69,13 +69,13 @@ jobs:
           fi
           echo "tag=${tag}" >> "$GITHUB_OUTPUT"
           echo "publishing as ${tag}"
-
       - name: Publish release and upload plugin
         env:
-          # Org-level secret holding a user token with write:repository scope.
-          # Not using a `||` fallback to GITEA_TOKEN: Gitea's expression engine
-          # supports only always(), so the operator would not evaluate.
-          GITEA_TOKEN: ${{ secrets.API_TOKEN }}
+          # Deliberately not named GITEA_TOKEN: the Actions runner injects its
+          # own GITEA_TOKEN into every step, and that value wins over a
+          # step-level `env:` of the same name, so the org secret would be
+          # silently ignored.
+          RELEASE_TOKEN: ${{ secrets.API_TOKEN }}
         run: |
           python3 tools/release.py \
             --api "${{ github.server_url }}/api/v1/repos/${{ github.repository }}" \