Warning: This build has drifted.
The coverage report for this pull request build may be inaccurate because its base commit is no longer the HEAD of its target branch.
This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

    • Learn more: For more information on this, see Tracking coverage changes for pull request builds.
    • Fix now: For a quick fix, rebase this PR at GitHub. Your next report should be accurate.
    • Prevent going forward: To avoid this issue with future PRs, see these Recommended CI Configurations.

fix(ci): address PR review findings on vendored aetherpak actions

Three confirmed issues from review:
- Scratch workflow needed contents: write, not read -- peaceiris/actions-gh-pages
  pushes a commit to gh-pages, which read-only permissions can't do.
- publish-site's actions/upload-pages-artifact was referenced by tag; pinned
  to its commit SHA to match this repo's convention elsewhere.
- publish-oci's registry-token input defaulted to the literal expression
  `${{ github.token }}`, which action.yml input defaults don't evaluate (only
  outputs.*.value does, confirmed against GitHub's docs) -- a caller omitting
  registry-token would get that literal string instead of a real token. This
  exists upstream too. Fixed by defaulting to empty and falling back via
  `inputs.registry-token || github.token` in the step's env mapping instead.

One review comment (bundle-path glob forwarded as a literal string) turned
out not to apply here: aetherpak's `import` command does call filepath.Glob
internally, and this repo's flatpak maker output is exactly one directory
level deep, which matches the `**` pattern's segment count -- verified by
reading cmd/import.go and this repo's MakerFlatpakBuilder rather than taking
the suggestion at face value.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>