ci(publish): use repository-level PACKAGE_TOKEN secret

.github/workflows/publish.yml

@@ -6,10 +6,6 @@ on:
       - 'v*'
   workflow_dispatch:
 
-permissions:
-  contents: read
-  packages: write
-
 jobs:
   publish:
     runs-on: ubuntu-latest
@@ -36,7 +32,7 @@ jobs:
       - name: Publish to Gitea Package Registry
         env:
           TWINE_USERNAME: __token__
-          TWINE_PASSWORD: ${{ github.token }}
+          TWINE_PASSWORD: ${{ secrets.PACKAGE_TOKEN }}
         run: |
           python3.12 -m twine upload \
             --repository-url https://git.jc2009.com/api/packages/client-jiangchang/pypi \