fix: secrets de registry sem prefixo GITEA_

Gitea rejeita nomes de secret reservados GITEA_*; workflows
e runbook passam a REGISTRY_PAT / REGISTRY_USER.

Co-authored-by: Cursor <cursoragent@cursor.com>

.gitea/workflows/promote-production.yml

@@ -56,8 +56,8 @@ jobs:
           registry: ${{ env.REGISTRY }}
           # Gitea's GITEA_TOKEN cannot push OCI packages (gitea#23642); a PAT
           # with read:package/write:package scopes is required instead.
-          username: ${{ secrets.GITEA_REGISTRY_USER }}
-          password: ${{ secrets.GITEA_PAT }}
+          username: ${{ secrets.REGISTRY_USER }}
+          password: ${{ secrets.REGISTRY_PAT }}
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3