ci: fix PACKAGE_TOKEN wiring - it's a Gitea Actions secret

The first tag run failed at docker login with "password is empty" -
$PACKAGE_TOKEN wasn't actually present as a bare env var in the job
shell the way I'd assumed. Checked the triggershell repo's own working
release workflow (same instance, same registry) for the real pattern:
it's a Gitea Actions secret (likely instance-wide, which is why it
didn't show up in this repo's own `tea actions secrets list`),
referenced via ${{ secrets.PACKAGE_TOKEN }} and mapped into the step's
env block, not inherited directly from the runner process.

.gitea/workflows/ci.yml

@@ -42,10 +42,10 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      # PACKAGE_TOKEN is provided by the runner environment, not a repo
-      # secret - it's already present in the job's shell environment.
       - name: Log in to the Gitea container registry
         run: echo "$PACKAGE_TOKEN" | docker login dev.pivoine.art -u ${{ github.repository_owner }} --password-stdin
+        env:
+          PACKAGE_TOKEN: ${{ secrets.PACKAGE_TOKEN }}
 
       - name: Build image
         run: |