Fall back to the runner token when the org secret is absent

pluginBase failed with "RELEASE_TOKEN is not set" while chatSummaries
published fine, from the same organisation secret. An organisation secret
is only exposed to a repository that has Actions enabled, so it can be
empty in one repo and present in another.

Try RELEASE_TOKEN first, then the runner-provided GITEA_TOKEN, which can
publish releases in its own repository, and report which one was used.
When none is set, name every variable that was tried and point at the
repository Actions setting rather than failing with a bare message.

The publish step also reports whether the organisation secret arrived,
printing only its length, so the fallback is visible in the job log.

.gitea/workflows/release.yml

@@ -71,12 +71,22 @@ jobs:
           echo "publishing as ${tag}"
       - name: Publish release and upload plugin
         env:
-          # Deliberately not named GITEA_TOKEN: the Actions runner injects its
-          # own GITEA_TOKEN into every step, and that value wins over a
-          # step-level `env:` of the same name, so the org secret would be
-          # silently ignored.
+          # Passed under a name the runner does not reserve. A step-level
+          # GITEA_TOKEN is overridden by the runner's own job token, so the
+          # org secret would be silently ignored under that name.
+          #
+          # RELEASE_TOKEN is the org-wide API_TOKEN secret. If it is empty --
+          # which happens when Actions is disabled on the repository, so org
+          # secrets are never exposed to it -- release.py falls back to the
+          # runner's GITEA_TOKEN, which can still publish to its own repo.
           RELEASE_TOKEN: ${{ secrets.API_TOKEN }}
         run: |
+          set -eu
+          if [ -n "${RELEASE_TOKEN:-}" ]; then
+            echo "org secret API_TOKEN is present (${#RELEASE_TOKEN} chars)"
+          else
+            echo "org secret API_TOKEN is empty; falling back to the runner token"
+          fi
           python3 tools/release.py \
             --api "${{ github.server_url }}/api/v1/repos/${{ github.repository }}" \
             --tag "${{ steps.tag.outputs.tag }}" \