ci: grant contents:read so publish can checkout private repo

Setting `permissions: packages: write` alone dropped every other scope to
none, so actions/checkout could not clone the private repo and the publish
job failed before building. Add contents:read, and use github.actor (more
reliably populated than gitea.actor) as the twine username.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -42,6 +42,7 @@ jobs:
     needs: [lint, test]
     runs-on: ubuntu-latest
     permissions:
+      contents: read   # needed for checkout of the private repo
       packages: write
     steps:
       - uses: actions/checkout@v4
@@ -70,7 +71,7 @@ jobs:
         env:
           # The auto-provided token works for the same owner's package registry.
           # Override with a PACKAGE_REGISTRY_TOKEN secret if your instance needs it.
-          TWINE_USERNAME: ${{ gitea.actor }}
+          TWINE_USERNAME: ${{ github.actor }}
           TWINE_PASSWORD: ${{ secrets.PACKAGE_REGISTRY_TOKEN || secrets.GITHUB_TOKEN }}
         run: |
           uvx twine upload \