ci: authenticate twine with REGISTRY_TOKEN secret

The repo already has a REGISTRY_TOKEN secret (Gitea access token with
package scope); the workflow referenced a non-existent PACKAGE_REGISTRY_TOKEN
and fell back to the auto GITHUB_TOKEN, which is not granted package-write,
so every upload was rejected. Point twine at REGISTRY_TOKEN.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -69,10 +69,10 @@ jobs:
 
       - name: Publish to Gitea PyPI registry
         env:
-          # The auto-provided token works for the same owner's package registry.
+          # REGISTRY_TOKEN is a Gitea access token with package read/write scope.
-          # Override with a PACKAGE_REGISTRY_TOKEN secret if your instance needs it.
+          # The auto GITHUB_TOKEN is not granted package-write here, so we use it.
           TWINE_USERNAME: ${{ github.actor }}
-          TWINE_PASSWORD: ${{ secrets.PACKAGE_REGISTRY_TOKEN || secrets.GITHUB_TOKEN }}
+          TWINE_PASSWORD: ${{ secrets.REGISTRY_TOKEN }}
         run: |
           # Gitea's PyPI registry does not support twine's --skip-existing, so
           # we run a plain upload and tolerate an "already exists" conflict in