Gitea forbids secret names starting with GITEA_; map the DEPLOY_TOKEN secret to the GITEA_TOKEN env var consumed by publish.sh.
Gitea forbids secret names starting with GITEA_; map the DEPLOY_TOKEN secret to the GITEA_TOKEN env var consumed by publish.sh.