ci: publish the Arch package with a package token

.gitea/workflows/arch-package.yml

@@ -13,7 +13,6 @@ on:
 
 permissions:
   contents: read
-  packages: write
 
 jobs:
   package:
@@ -49,7 +48,9 @@ jobs:
           su builder -c "cd $dir && makepkg --noconfirm"
       - name: Publish
         env:
-          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # The package registry rejects the job token, so this is a personal access token
+          # with the write:package scope.
+          TOKEN: ${{ secrets.PACKAGE_TOKEN }}
         run: |
           for f in /tmp/pkg/qtpotato-[0-9]*.pkg.tar.zst; do
               curl -fsS -X PUT -H "Authorization: token $TOKEN" --upload-file "$f" \