ci: rename bump secret to BUMP_TOKEN

Gitea reserves the GITEA_ prefix for secret names, so the workflow secret
can't be GITEA_TOKEN. Rename it (and the env var the script reads) to
BUMP_TOKEN.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/bump-version.sh

@@ -4,7 +4,7 @@
 # ebuild, regenerate the Manifest, and open a pull request.
 #
 # Expects a Gentoo environment with: go, pkgdev, git, curl, xz, jq.
-# Required env: GITEA_TOKEN, GITHUB_SERVER_URL, GITHUB_REPOSITORY.
+# Required env: BUMP_TOKEN, GITHUB_SERVER_URL, GITHUB_REPOSITORY.
 # Optional env: GITHUB_API_URL (defaults to ${GITHUB_SERVER_URL}/api/v1).
 set -euo pipefail
 
@@ -13,13 +13,13 @@ UPSTREAM_RSS="https://gitea.com/gitea/runner/releases.rss"
 UPSTREAM_ARCHIVE="https://gitea.com/gitea/runner/archive"
 UPSTREAM_GOMOD="https://gitea.com/gitea/runner/raw/tag"
 
-: "${GITEA_TOKEN:?GITEA_TOKEN is required}"
+: "${BUMP_TOKEN:?BUMP_TOKEN is required}"
 : "${GITHUB_SERVER_URL:?GITHUB_SERVER_URL is required}"
 : "${GITHUB_REPOSITORY:?GITHUB_REPOSITORY is required}"
 API="${GITHUB_API_URL:-${GITHUB_SERVER_URL}/api/v1}"
 
 host=${GITHUB_SERVER_URL#http://}; host=${host#https://}
-api() { curl -fsSL -H "Authorization: token ${GITEA_TOKEN}" "$@"; }
+api() { curl -fsSL -H "Authorization: token ${BUMP_TOKEN}" "$@"; }
 
 # --- determine versions ------------------------------------------------------
 latest=$(curl -fsSL "$UPSTREAM_RSS" \
@@ -28,7 +28,7 @@ latest=$(curl -fsSL "$UPSTREAM_RSS" \
 [ -n "$latest" ] || { echo "could not parse upstream version"; exit 1; }
 
 WORK=$(mktemp -d)
-git clone "https://x-access-token:${GITEA_TOKEN}@${host}/${GITHUB_REPOSITORY}.git" "$WORK"
+git clone "https://x-access-token:${BUMP_TOKEN}@${host}/${GITHUB_REPOSITORY}.git" "$WORK"
 cd "$WORK"
 pkgdir="dev-util/${PN}"