Gitea forbids secret names starting with GITEA_; map the DEPLOY_TOKEN secret to the GITEA_TOKEN env var consumed by publish.sh.
OPA/Rego deployment gateway policies: 5 rules (valid-environment, require-approvals, no-self-approval, block-weekends, freeze-window), a deploy-gate combining them, JSON schemas, scenario-driven tests, Gitea Actions CI (verify + publish to generic registry), changesets versioning, Makefile and scripts.