ci: split tokens — GITHUB_TOKEN for own repo, read-only PAT for upstream

The package-scoped REGISTRY_TOKEN cannot clone repos (403). Own-repo
operations (checkout, pages push, tag, release) now use the auto-provided
GITHUB_TOKEN; the private upstream clone uses the new read-only secret
HeiniRemoteFlatpakActionReleases.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/build-flatpak.yml

@@ -51,14 +51,13 @@ jobs:
       # Plain git clone instead of actions/checkout@v4: the bare ubuntu image
       # has no Node.js, so JavaScript actions fail with exit 127.
       #
-      # REGISTRY_TOKEN is the user-wide write PAT the other repos' actions
-      # already use. It is required (not just preferred): the auto-provided
-      # GITHUB_TOKEN is scoped to THIS repo only, so it cannot clone the
-      # private upstream HeiniRemote. The GITHUB_TOKEN fallback exists just so
-      # the own-repo steps still work if the secret is ever unset.
+      # Token split: the auto-provided GITHUB_TOKEN covers everything in THIS
+      # repo (checkout, pages push, tag, release). HeiniRemoteFlatpakActionReleases
+      # — a read-only PAT (repository: read) — is only needed where the private
+      # upstream HeiniRemote is cloned, which GITHUB_TOKEN cannot reach.
       - name: Checkout
         env:
-          TOKEN: ${{ secrets.REGISTRY_TOKEN != '' && secrets.REGISTRY_TOKEN || secrets.GITHUB_TOKEN }}
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           AUTH_URL="$(echo "${GITHUB_SERVER_URL}" | sed "s#://#://${GITHUB_ACTOR}:${TOKEN}@#")/${GITHUB_REPOSITORY}.git"
           git init -q
@@ -70,7 +69,7 @@ jobs:
       - name: Resolve upstream HeiniRemote version
         id: ver
         env:
-          TOKEN: ${{ secrets.REGISTRY_TOKEN != '' && secrets.REGISTRY_TOKEN || secrets.GITHUB_TOKEN }}
+          TOKEN: ${{ secrets.HeiniRemoteFlatpakActionReleases }}
         run: |
           chmod +x scripts/*.sh
           export UPSTREAM_URL="$(echo "${GITHUB_SERVER_URL}" | sed "s#://#://${GITHUB_ACTOR}:${TOKEN}@#")/pc-heini/HeiniRemote.git"
@@ -106,7 +105,7 @@ jobs:
       - name: Build agent from upstream source
         if: steps.check.outputs.build == 'true'
         env:
-          TOKEN: ${{ secrets.REGISTRY_TOKEN != '' && secrets.REGISTRY_TOKEN || secrets.GITHUB_TOKEN }}
+          TOKEN: ${{ secrets.HeiniRemoteFlatpakActionReleases }}
         run: |
           UPSTREAM_URL="$(echo "${GITHUB_SERVER_URL}" | sed "s#://#://${GITHUB_ACTOR}:${TOKEN}@#")/pc-heini/HeiniRemote.git"
           # init+fetch instead of clone: works for tags and bare commit shas alike.
@@ -157,7 +156,7 @@ jobs:
       - name: Publish OSTree repo to the 'pages' branch
         if: steps.check.outputs.build == 'true'
         env:
-          TOKEN: ${{ secrets.REGISTRY_TOKEN != '' && secrets.REGISTRY_TOKEN || secrets.GITHUB_TOKEN }}
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           AUTH_URL="$(echo "${{ github.server_url }}" | sed "s#://#://${{ github.actor }}:${TOKEN}@#")/${{ github.repository }}.git"
           rm -rf publish && mkdir publish && cd publish
@@ -175,7 +174,7 @@ jobs:
       - name: Tag and release the published version
         if: steps.check.outputs.build == 'true'
         env:
-          TOKEN: ${{ secrets.REGISTRY_TOKEN != '' && secrets.REGISTRY_TOKEN || secrets.GITHUB_TOKEN }}
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITEA_API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
         run: |
           AUTH_URL="$(echo "${{ github.server_url }}" | sed "s#://#://${{ github.actor }}:${TOKEN}@#")/${{ github.repository }}.git"