fix: make docker build/push work with Gitea

- Replace type=gha cache (broken on Gitea: unparseable runtime token)
  with type=registry cache using image-manifest/oci-mediatypes options
  that the Gitea registry accepts.
- Push with a Gitea PAT (REGISTRY_TOKEN) since the auto job token
  cannot publish OCI images to the package repo.
- Add registry login to the CI docker smoke-test job.

.gitea/workflows/publish.yml

@@ -12,9 +12,6 @@ env:
 jobs:
   build-and-push:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
 
     steps:
       - uses: actions/checkout@v4
@@ -24,8 +21,8 @@ jobs:
       - uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
-          username: ${{ gitea.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          username: ${{ gitea.repository_owner }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
 
       - uses: docker/metadata-action@v5
         id: meta
@@ -43,3 +40,5 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
+          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache,mode=max,image-manifest=true,oci-mediatypes=true