Setting `permissions: packages: write` alone dropped every other scope to none, so actions/checkout could not clone the private repo and the publish job failed before building. Add contents:read, and use github.actor (more reliably populated than gitea.actor) as the twine username. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>