ci: use scoped Gitea release token

tests/release-scripts.test.sh

@@ -488,6 +488,16 @@ test_no_service_install_disables_online_update() (
   grep -Fqx 'OA_UPDATE_ENABLED=false' "$CONFIG_ROOT/erp.env"
 )
 
+test_release_workflow_uses_scoped_job_token() (
+  local workflow="$PROJECT_ROOT/.gitea/workflows/release.yml"
+  grep -Fqx '  contents: read' "$workflow"
+  grep -Fqx '  releases: write' "$workflow"
+  grep -Fq 'GITEA_BASE_URL: ${{ github.server_url }}' "$workflow"
+  grep -Fq 'GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}' "$workflow"
+  ! grep -Fq 'RELEASE_GITEA_TOKEN' "$workflow"
+  ! grep -Fq 'vars.GITEA_BASE_URL' "$workflow"
+)
+
 run_test 'erp-run preserves Java option arguments' test_erp_run_preserves_java_option_arguments
 run_test 'installer accepts a correctly signed archive' test_installer_verifies_signed_safe_archive
 run_test 'installer rejects symlinks in release archives' test_installer_rejects_archive_symlinks
@@ -499,6 +509,7 @@ run_test 'update helper rejects a concurrent process' test_update_lock_rejects_c
 run_test 'noninteractive install reports a missing database password' test_noninteractive_installer_reports_missing_password
 run_test 'installer requires an explicit Gitea URL' test_installer_requires_explicit_gitea_url
 run_test 'no-service install disables online update' test_no_service_install_disables_online_update
+run_test 'release workflow uses the scoped Gitea job token' test_release_workflow_uses_scoped_job_token
 
 printf 'RESULT pass=%s fail=%s\n' "$PASS" "$FAIL"
 [[ "$FAIL" -eq 0 ]]