Push auto-release tags as renovate-bot so release.yml fires, and give the Docker Hub page its short description

.gitea/workflows/release.yml

@@ -81,7 +81,8 @@ jobs:
       - uses: actions/checkout@v7.0.1
         if: github.event_name == 'push'
       # Publish the named release's own tree, so the page never pairs one Plainpages tag with another
-      # release's sidecar pins. A version that was never released fails here.
+      # release's sidecar pins, which is also why it never syncs on a push to main. A version that
+      # was never released fails here.
       - uses: actions/checkout@v7.0.1
         if: github.event_name == 'workflow_dispatch'
         with:

.gitea/workflows/renovate.yml

@@ -38,6 +38,9 @@ jobs:
       - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
+          # A persisted token rides every request as an extraheader, outranking the PAT in the push
+          # URL: Gitea then sees the Actions bot push the tag and starts no workflow for it.
+          persist-credentials: false
       - name: Tag a release for what Renovate merged
         env:
           RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}