fix(actionlint): replace curl with wget, fix secrets.GITEA_TOKEN references

- pr-validation.yaml: Use env block to avoid github.head_ref/github.base_ref
  as shell expressions in run block (actionlint error)
- plugin-release.yaml: Replace remaining 6x secrets.GITEA_TOKEN with
  secrets.GITEA_RELEASE_TOKEN (lines 186, 218, 293, 310, 343, 401)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.github/workflows/pr-validation.yaml

@@ -11,10 +11,13 @@ jobs:
 
     steps:
       - name: Checkout
+        env:
+          HEAD_REF: ${{ github.head_ref }}
+          BASE_REF: ${{ github.base_ref }}
         run: |
           git clone --depth=1 "https://x-access-token:${{ secrets.GITEA_TOKEN }}@git.farh.net/${{ github.repository }}.git" .
-          git fetch origin "${{ github.base_ref }}" --depth=1
-          git fetch origin "${{ github.head_ref }}" --depth=1
+          git fetch origin "$BASE_REF" --depth=1
+          git fetch origin "$HEAD_REF" --depth=1
           git checkout "${{ github.sha }}"
 
       - name: Install actionlint