CI: pass explicit PAT to checkout (Gitea auto-token 403 on private repo)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/build.yml

@@ -18,6 +18,10 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          # Gitea's auto Actions-token returned 403 on the private repo checkout;
+          # use an explicit PAT (repo read) provided as the CI_TOKEN secret.
+          token: ${{ secrets.CI_TOKEN }}
 
       - name: Herstel signing keystore uit secret
         run: |