ci: grant the job token packages:write for the registry push

Kaniko's up-front push-permission check 401'd (reqPackageAccess): the Forgejo
auto GITHUB_TOKEN has no package-write scope by default. Declare
`permissions: {contents: read, packages: write}` so the token can push to the
forge container registry (git clone still needs contents:read).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/deploy.yml

@@ -13,6 +13,13 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# The auto GITHUB_TOKEN needs `packages: write` to push to the forge's container
+# registry — without it Kaniko's push-permission check 401s (reqPackageAccess).
+# `contents: read` keeps git clone (checkout / Kaniko git context) working.
+permissions:
+  contents: read
+  packages: write
+
 env:
   # This forge's built-in container registry, same host as the git server.
   REGISTRY: git.ziemlichoptimal.de