rootiest
028478940f
The default `secrets.GITEA_TOKEN` is Gitea Actions' built-in synthetic bot identity, not a whitelistable user account. main's branch protection rejects its pushes outright regardless of retries (run 983, run 990) -- the retry/rebase loop in the next step was built for a non-fast-forward race (run 976), not a bare permission rejection, so it can't recover from this. Point the docs job's checkout token at BOT_PUSH_TOKEN, a PAT on the already-bypass-whitelisted rootiest account, so the later push succeeds. Commit authorship and GPG signing (fishconfig-bot) are set separately via git config a few steps later and are unaffected -- push auth and commit identity are independent.