Use a package-scoped token for Gitea's container registry login

Gitea's own auto-injected GITHUB_TOKEN isn't authorized to write
packages on this instance even with packages:write declared, so the
Gitea-side publish kept failing at login despite targeting the right
registry. Added a REGISTRY_TOKEN repo secret (Gitea PAT scoped to
package: read/write only) and use it when the runner is Gitea; GitHub
keeps using its own real GITHUB_TOKEN for ghcr.io.

.github/workflows/publish-container.yml

@@ -34,7 +34,7 @@ jobs:
         with:
           registry: ${{ steps.registry.outputs.registry }}
           username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          password: ${{ github.server_url == 'https://github.com' && secrets.GITHUB_TOKEN || secrets.REGISTRY_TOKEN }}
 
       - name: Generate image tags
         id: meta