Document CI_TOKEN's write:repository scope requirement (gitea #50)

The prior e2e run (task 1348) failed on the bump-version job's push step
with a 403 Forbidden — CI_TOKEN lacked write access. Note this on the
checkout step so the requirement isn't lost, now that the token has been
rescoped. Trivial commit to re-open a merge request and re-run the job
end to end.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -98,6 +98,9 @@ jobs:
       volumes:
         - /srv/act-runner-cache/uv:/uv-cache
     steps:
+      # CI_TOKEN needs write:repository scope (not just read) — this job
+      # pushes commits and tags to master, unlike ruff-check/ruff-format/
+      # type-check/test above, which only need to check out the repo.
       - uses: actions/checkout@v4
         with:
           token: ${{ secrets.CI_TOKEN }}