fix(workflow): wiki-mirror jobs request the wiki: write token scope (#192)

The job token got HTTP 403 creating the first wiki page: Gitea gives the wiki its own
permission scope, which contents: write does not cover.

Files changed:
- .gitea/scripts/wiki-push.sh
- .gitea/workflows/release.yml
- .gitea/workflows/wiki-mirror.yml

Co-Authored-By: Claude Code <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SnAJ7Z3CpVD3PRbN73QtU2

.gitea/scripts/wiki-push.sh

@@ -19,8 +19,8 @@ version="${2:?usage: wiki-push.sh <output-dir> <version>}"
 
 if [ -z "${WIKI_TOKEN:-}" ]; then
   echo "ERROR WIKI_TOKEN is empty: the wiki mirror needs a token that may push to the wiki repository." >&2
-  echo "      The job token (gitea.token) is tried first; if Gitea refuses it, the operator adds a" >&2
-  echo "      repository secret with write access and the workflow passes that one instead." >&2
+  echo "      The job token (gitea.token) is used with 'permissions: wiki: write'; if Gitea still refuses it," >&2
+  echo "      the repository's Actions settings cap the token, or the operator adds a secret with write access." >&2
   exit 1
 fi
 [ -f "$out/Home.md" ] || { echo "ERROR $out/Home.md is missing - not a converter output" >&2; exit 1; }

.gitea/workflows/release.yml

@@ -255,6 +255,7 @@ jobs:
       image: debian:trixie-slim
     permissions:
       contents: write
+      wiki: write
     env:
       VERSION: ${{ needs.release.outputs.version }}
       TAG: ${{ needs.release.outputs.tag }}

.gitea/workflows/wiki-mirror.yml

@@ -29,6 +29,7 @@ jobs:
       image: debian:trixie-slim
     permissions:
       contents: write
+      wiki: write
     env:
       PUBLIC_BASE_URL: https://gitea.nehmer.net