spike(ci): authenticate with a package-scoped PAT instead of the Actions token (#237)

Iteration 2 got as far as the registry and was refused with a 401, not a certificate error, which established that everything except the credential already worked: the docker CLI installs, the daemon is reachable through the mounted socket, the container registry answers on /v2/, and TLS to the Gitea host is trusted from the runner.

The token Actions injects automatically is scoped for the repository API and is not accepted by the package registry. This switches to REGISTRY_TOKEN, a personal access token carrying write:package, which is the one thing the workflow could not arrange for itself.

Ref #237

.gitea/workflows/spike-registry.yml

@@ -85,20 +85,26 @@ jobs:
           echo "--- can it reach the daemon through the socket? ---"
           docker info --format 'server {{.ServerVersion}}, {{.Driver}}, {{.Architecture}}'
 
-      # Reported as a boolean, never printed. If this says NO, the login below
-      # will fail and the fix is to add the secret, not to change the workflow.
+      # REGISTRY_TOKEN, not GITEA_TOKEN. Iteration 2 established that the token
+      # Actions injects automatically is scoped for the repository API and is
+      # refused by the package registry — the login failed with a 401, not a
+      # certificate error, so everything except the credential was already
+      # working. This is a personal access token carrying write:package.
+      #
+      # Reported as a boolean and never printed. If this says EMPTY the fix is
+      # the secret, not the workflow.
       - name: Is a token available?
         continue-on-error: true
         run: |
-          if [ -n "${{ secrets.GITEA_TOKEN }}" ]; then
-            echo "GITEA_TOKEN is present"
+          if [ -n "${{ secrets.REGISTRY_TOKEN }}" ]; then
+            echo "REGISTRY_TOKEN is present"
           else
-            echo "GITEA_TOKEN is EMPTY — add a repo secret with package write scope"
+            echo "REGISTRY_TOKEN is EMPTY — add a repo secret holding a PAT with write:package"
           fi
 
       - name: Question 2a — log in to the registry
         run: |
-          echo "${{ secrets.GITEA_TOKEN }}" \
+          echo "${{ secrets.REGISTRY_TOKEN }}" \
             | docker login "$REGISTRY" -u "${{ github.actor }}" --password-stdin
 
       # A trivial image first, deliberately. It separates "can this runner build