The GITHUB_TOKEN auto-generated by Forgejo Actions requires explicit
packages:write scope to authenticate with the Forgejo container registry.
Without this, docker/login-action fails with a 401/403, which caused all
builds to fail within ~30 seconds at the login step.
Also adds contents:read as a best-practice minimal-privilege declaration.
