Fix token

.gitea/workflows/ci.yaml

@@ -33,6 +33,15 @@ jobs:
     defaults:
       run:
         shell: sh
+    env:
+      # Gitea auto-generates a per-job `secrets.GITHUB_TOKEN` (read-scoped
+      # to this repo) for compat with GitHub Actions, but act_runner does
+      # NOT auto-export it as an env var — referencing it explicitly here
+      # makes it available to the Checkout step's `git fetch`. Same role
+      # as `secrets.RUNNER_REPO_PAT` / `CALLER_REPO_PAT` in the Charlie
+      # deploy/build workflows, except we don't need a long-lived PAT —
+      # the per-job token is enough for a one-shot fetch.
+      GITHUB_TOKEN: ${{ github.token }}
     steps:
       - name: Install Go and curl
         run: |