fix(actionlint): resolve untrusted github.head_ref and undefined secrets

- Add env vars for HEAD_REF and BASE_REF in detect-pr-pipeline.yaml to avoid
  using github.head_ref/github.base_ref directly in inline scripts (actionlint rule)
- Fix plugin-release.yaml to use secrets.GITEA_RELEASE_TOKEN instead of
  undefined secrets.GITEA_TOKEN (3 occurrences)

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.github/workflows/plugin-release.yaml

@@ -39,7 +39,7 @@ jobs:
       - name: Verify GITEA_RELEASE_TOKEN is configured
         id: check
         env:
-          GITEA_RELEASE_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITEA_RELEASE_TOKEN: ${{ secrets.GITEA_RELEASE_TOKEN }}
         run: |
           if [ -z "$GITEA_RELEASE_TOKEN" ]; then
             echo "::notice::GITEA_RELEASE_TOKEN org secret is not configured (see PRI-1533). Release skipped — no artifacts will be created."
@@ -65,7 +65,7 @@ jobs:
       - name: Check write permissions via API
         id: check
         env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITEA_TOKEN: ${{ secrets.GITEA_RELEASE_TOKEN }}
           REPO: ${{ github.repository }}
         run: |
           HTTP_CODE=$(curl -sf -o /dev/null -w "%{http_code}" \
@@ -101,7 +101,7 @@ jobs:
       - name: Check if tag already exists
         id: check
         env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITEA_TOKEN: ${{ secrets.GITEA_RELEASE_TOKEN }}
           REPO: ${{ github.repository }}
         run: |
           HTTP_CODE=$(curl -sf -o /dev/null -w "%{http_code}" \