fix(P1): add CI_GITEA_TOKEN for shell-isolated env forwarding

CoreCI's buildIsolatedEnv only forwards CI_* and CORECI_* prefixed vars
from os.Environ(). GITEA_TOKEN is not prefixed, so it's only available
if it's in the job vars map (via ${{ secrets.GITEA_TOKEN }}). The
secret resolver's os.Getenv fallback should work, but to be safe, also
set CI_GITEA_TOKEN in the workflow env (always forwarded as a CI_* var).

Add debug output for GITEA_TOKEN length and CI context vars.

---ci---
project: orca
phase: 1
milestone: v0.16
status: execute
---/ci---

.gitea/workflows/release.yml

@@ -29,6 +29,7 @@ jobs:
       - name: Run CoreCI pipeline
         env:
           GITEA_TOKEN: ${{ secrets.PAT_TOKEN }}
+          CI_GITEA_TOKEN: ${{ secrets.PAT_TOKEN }}
         run: |
           coreci run
 

scripts/ci-run.sh

@@ -104,11 +104,15 @@ case "$JOB" in
     BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
     TARBALL="orca-${VERSION}-linux-amd64.tar.gz"
 
-    if [ -z "${GITEA_TOKEN:-}" ]; then
+    if [ -z "${GITEA_TOKEN:-${CI_GITEA_TOKEN:-}}" ]; then
       err "GITEA_TOKEN is not set"
     fi
+    GITEA_TOKEN="${GITEA_TOKEN:-${CI_GITEA_TOKEN:-}}"
 
     info "building release binary ${VERSION}..."
+    info "GITEA_TOKEN length: ${#GITEA_TOKEN}"
+    info "CI_COMMIT_BRANCH=${CI_COMMIT_BRANCH:-unset}"
+    info "CI_COMMIT_SHA=${CI_COMMIT_SHA:-unset}"
     LDFLAGS="-s -w \
       -X git.cloudinit.dev/coreci/orca/internal/cli.version=${VERSION} \
       -X git.cloudinit.dev/coreci/orca/internal/cli.gitCommit=${GIT_COMMIT} \
@@ -117,7 +121,7 @@ case "$JOB" in
     go build -trimpath -ldflags="${LDFLAGS}" -o bin/orca ./cmd/orca 2>&1 || err "go build failed"
     tar -czf "${TARBALL}" -C bin orca
     sha256sum "${TARBALL}" > SHA256SUMS
-    info "built ${TARBALL}"
+    info "built ${TARBALL} ($(wc -c < "${TARBALL}") bytes)"
 
     # Create or update the Gitea release directly via the API.
     # The CIAgent ship workflow may have already created the release