Fall back to the runner token when the org secret is absent

pluginBase failed with "RELEASE_TOKEN is not set" while chatSummaries
published fine, from the same organisation secret. An organisation secret
is only exposed to a repository that has Actions enabled, so it can be
empty in one repo and present in another.

Try RELEASE_TOKEN first, then the runner-provided GITEA_TOKEN, which can
publish releases in its own repository, and report which one was used.
When none is set, name every variable that was tried and point at the
repository Actions setting rather than failing with a bare message.

The publish step also reports whether the organisation secret arrived,
printing only its length, so the fallback is visible in the job log.

tools/release.py

@@ -152,16 +152,35 @@ def main(argv: Optional[list] = None) -> int:
     parser.add_argument(
         "--token-env",
         default="RELEASE_TOKEN",
-        help="environment variable holding the API token (default: RELEASE_TOKEN)",
+        help="preferred environment variable holding the API token",
     )
     args = parser.parse_args(argv)
 
-    # Read from an explicitly named variable rather than GITEA_TOKEN: the
-    # Actions runner injects its own GITEA_TOKEN into every step, which
-    # silently wins over a step-level `env:` of the same name.
-    token = os.environ.get(args.token_env, "")
+    # Preferred name first, then the runner-provided job token. GITEA_TOKEN is
+    # not used as the primary name because the Actions runner injects its own
+    # value for it into every step, which overrides a step-level `env:` entry
+    # of the same name -- but it is a valid last resort, since it can publish
+    # releases in its own repository.
+    candidates = [args.token_env, "RELEASE_TOKEN", "GITEA_TOKEN", "GITHUB_TOKEN"]
+    token, token_source = "", ""
+    for name in candidates:
+        value = os.environ.get(name, "").strip()
+        if value:
+            token, token_source = value, name
+            break
     if not token:
-        fail(f"{args.token_env} is not set")
+        present = sorted(n for n in candidates if n in os.environ)
+        fail(
+            f"no API token found; looked at {', '.join(dict.fromkeys(candidates))}. "
+            + (
+                f"These exist but are empty: {', '.join(present)}. "
+                "An organisation secret is only exposed to a repository when Actions "
+                "is enabled on that repository, so check Repo > Settings > Actions."
+                if present
+                else "None of them are set in the environment."
+            )
+        )
+    print(f"using token from {token_source}")
 
     artifact = Path(args.artifact)
     if not artifact.is_file() or artifact.stat().st_size == 0: