The package-scoped REGISTRY_TOKEN cannot clone repos (403). Own-repo
operations (checkout, pages push, tag, release) now use the auto-provided
GITHUB_TOKEN; the private upstream clone uses the new read-only secret
HeiniRemoteFlatpakActionReleases.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>