Release Tag still authenticates GoReleaser with secrets.RELEASE_TOKEN, a
legacy PAT that CI policy no longer wants refreshed. Prefer the job
built-in token with contents: write, mirror it into GITHUB_TOKEN the way
vulture does, and force GoReleaser onto the Gitea token path.
Link: #11