ci(forgejo): configure act-runner container image, registry host, and package permissions

.forgejo/workflows/build-push.yml

@@ -9,6 +9,7 @@ on:
     tags:
       - 'v*'
 
+# Grant permissions to push packages to Forgejo Container Registry and create releases
 permissions:
   contents: write
   packages: write
@@ -28,6 +29,7 @@ jobs:
       - name: Extract Registry Host
         id: reg
         run: |
+          # Strip protocol scheme (http:// or https://) for Docker registry reference
           SERVER_HOST=$(echo "${{ gitea.server_url }}" | sed -e 's|^https\?://||')
           echo "host=${SERVER_HOST}" >> "$GITHUB_OUTPUT"
 
@@ -39,7 +41,7 @@ jobs:
         with:
           registry: ${{ steps.reg.outputs.host }}
           username: ${{ gitea.actor }}
-          password: ${{ secrets.REGISTRY_TOKEN || secrets.GITHUB_TOKEN }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Extract Metadata for Docker
         id: meta
@@ -59,7 +61,8 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          provenance: false
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
 
   create-release:
     needs: build-and-push
@@ -86,7 +89,7 @@ jobs:
           echo "Creating release ${RELEASE_NAME} with tag ${TAG_NAME}..."
 
           curl -s -X POST "${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}/releases" \
-            -H "Authorization: token ${{ secrets.REGISTRY_TOKEN || secrets.GITHUB_TOKEN }}" \
+            -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
             -H "Content-Type: application/json" \
             -d "{
               \"tag_name\": \"${TAG_NAME}\",