The tagless fallback truncated the sha to 12 chars for the version string
and reused that as ref, so the upstream fetch failed with
'couldn't find remote ref'. Keep the full sha for ref, shorten only the
version suffix.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The package-scoped REGISTRY_TOKEN cannot clone repos (403). Own-repo
operations (checkout, pages push, tag, release) now use the auto-provided
GITHUB_TOKEN; the private upstream clone uses the new read-only secret
HeiniRemoteFlatpakActionReleases.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>