fixed registry authentication

.gitea/workflows/container.yml

@@ -48,13 +48,26 @@ jobs:
 
       - uses: docker/setup-buildx-action@v3
 
+      # Gitea job tokens (GITEA_TOKEN / github.token) cannot log into the
+      # container registry. A PAT with package read/write is required.
+      # https://docs.gitea.com/usage/actions/comparison
+      - name: Require registry PAT
+        if: github.event_name != 'pull_request'
+        env:
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          if [ -z "$REGISTRY_TOKEN" ]; then
+            echo "::error::Add a Gitea PAT with package read/write as the REGISTRY_TOKEN secret (repo or org). Job tokens cannot authenticate to https://${REGISTRY}/v2/."
+            exit 1
+          fi
+
       - name: Log in to the Gitea Container Registry
         if: github.event_name != 'pull_request'
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ secrets.REGISTRY_USERNAME || github.actor }}
-          password: ${{ secrets.REGISTRY_TOKEN || secrets.GITEA_TOKEN }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Build and push
         uses: docker/bake-action@v6