ci: use REGISTRY_TOKEN PAT for container registry auth

The auto-provided GITEA_TOKEN doesn't grant write:package scope
in Gitea 1.25 even when permissions.packages: write is declared.
Switch registry logins to a dedicated PAT stored as REGISTRY_TOKEN.
Keep GITEA_TOKEN for semantic-release-gitea API calls.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/helm-release.yml

@@ -31,7 +31,7 @@ jobs:
 
       - name: Log in to Gitea OCI registry
         run: |
-          echo "${{ secrets.GITEA_TOKEN }}" | helm registry login git.farh.net \
+          echo "${{ secrets.REGISTRY_TOKEN }}" | helm registry login git.farh.net \
             --username "${{ github.actor }}" \
             --password-stdin