The repo already has a REGISTRY_TOKEN secret (Gitea access token with package scope); the workflow referenced a non-existent PACKAGE_REGISTRY_TOKEN and fell back to the auto GITHUB_TOKEN, which is not granted package-write, so every upload was rejected. Point twine at REGISTRY_TOKEN. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>