ci: rename bump secret to BUMP_TOKEN

Gitea reserves the GITEA_ prefix for secret names, so the workflow secret
can't be GITEA_TOKEN. Rename it (and the env var the script reads) to
BUMP_TOKEN.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

README.md

@@ -26,5 +26,5 @@ emerge dev-util/gitea-runner
   every push and asserts the resulting binary runs.
 - `.gitea/workflows/bump.yaml` runs `scripts/bump-version.sh` daily: it checks the
   upstream releases feed and, when a newer version exists, regenerates + uploads the
-  vendor tarball, bumps the ebuild, and opens a pull request. Requires a `GITEA_TOKEN`
+  vendor tarball, bumps the ebuild, and opens a pull request. Requires a `BUMP_TOKEN`
   repository secret (scopes: repository read/write, write release).