Release Tag was publishing via secrets.RELEASE_TOKEN, a long-lived
PAT. Prefer the job built-in token with contents: write, matching the
vulture GoReleaser path: set GITEA_TOKEN and GITHUB_TOKEN from
secrets.GITEA_TOKEN and force GoReleaser onto the Gitea token.
Link: #9
s1d3sw1ped_bot