ci: push images as the reweave-ci bot

Gitea's registry refuses the job token (no package scope at login), so log
in as reweave-ci with the org secret REGISTRY_TOKEN, and drop the
packages permission that had no effect.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UHXzGrsxfkGk8LmwrBbHNZ

.gitea/workflows/images.yml

@@ -15,9 +15,10 @@ on:
       - "**.md"
   workflow_dispatch:
 
+# The job token can't log in to the registry (no package scope there), so
+# the push uses the reweave-ci bot's token from the org secret REGISTRY_TOKEN.
 permissions:
   contents: read
-  packages: write
 
 jobs:
   images:
@@ -31,7 +32,7 @@ jobs:
           fetch-depth: 0 # tags, for the version string
 
       - name: Log in to the registry
-        run: echo "${{ secrets.GITEA_TOKEN }}" | docker login "$REGISTRY" -u "${{ gitea.actor }}" --password-stdin
+        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login "$REGISTRY" -u reweave-ci --password-stdin
 
       - name: Build and push (linux/amd64)
         run: |