fix: use the registry secret that exists, and allow manual releases

The login step referenced PACKAGES_SECRET while the secret configured on this
repository -- and on its sibling -- is PACKAGES_TOKEN. The expression resolved
to an empty string and docker/login-action failed with "Password required",
so the first release published nothing and created no tag.

The push trigger only fires on image-affecting paths, which a workflow-only
change is not, so merging this fix alone would not produce a release.
workflow_dispatch can now cut one, restricted to main so a manual run on
another branch cannot tag a commit that is not on the default branch.

Verified by running the version step across every event and ref combination:
push and workflow_dispatch on main release, everything else does not.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitea/workflows/build-and-publish.yaml

@@ -89,8 +89,14 @@ jobs:
           minor="${rest%%.*}"
           patch="${rest##*.}"
 
+          # workflow_dispatch releases too, so a release can be cut without a
+          # code change -- the push filter above ignores workflow and doc edits.
+          # Restricted to main: a manual run elsewhere must not tag a commit
+          # that is not on the default branch.
           release="false"
-          if [ "${GITHUB_EVENT_NAME}" = "push" ] && [ "$bump" != "none" ]; then
+          if [ "${GITHUB_EVENT_NAME}" != "pull_request" ] \
+             && [ "${GITHUB_REF_NAME}" = "main" ] \
+             && [ "$bump" != "none" ]; then
             release="true"
             case "$bump" in
               major) major=$((major + 1)); minor=0; patch=0 ;;
@@ -127,7 +133,7 @@ jobs:
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.repository_owner }}
-          password: ${{ secrets.PACKAGES_SECRET }}
+          password: ${{ secrets.PACKAGES_TOKEN }}
 
       - name: Build and push
         uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7