Read PKG_TOKEN at job-level env (not workflow-level)

The secrets context is not available to workflow-level env, so
`PKG_TOKEN: ${{ secrets.PKG_TOKEN }}` there resolved to empty and the publish
step's guard failed. Declare it in the preflight and build job env blocks
instead, where the secrets context is available.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/build.yml

@@ -18,9 +18,9 @@ env:
   # https://git.chilldove.com/api/packages/icePigeon/debian
   PKG_REGISTRY: ${{ github.server_url }}/api/packages/${{ github.repository_owner }}/debian
   PKG_USER: ${{ github.repository_owner }}
-  # Dedicated token with write:package scope. The auto-injected GITHUB_TOKEN is
-  # not guaranteed to carry package-write permission, so this is a repo secret.
-  PKG_TOKEN: ${{ secrets.PKG_TOKEN }}
+  # NOTE: PKG_TOKEN (the write:package secret) is declared at JOB level below. The
+  # secrets context is not available to workflow-level env, so a value set here
+  # would silently be empty.
 
 permissions:
   # Uploads authenticate via the PKG_TOKEN secret, not the auto-injected token,
@@ -34,6 +34,8 @@ concurrency:
 jobs:
   preflight:
     runs-on: ubuntu-latest
+    env:
+      PKG_TOKEN: ${{ secrets.PKG_TOKEN }}
     outputs:
       kernel_version: ${{ steps.plan.outputs.kernel_version }}
       build_needed: ${{ steps.plan.outputs.build_needed }}
@@ -98,6 +100,7 @@ jobs:
       ARCH: ${{ matrix.arch }}
       DEB_ARCH: ${{ matrix.deb_arch }}
       KERNEL_VERSION: ${{ needs.preflight.outputs.kernel_version }}
+      PKG_TOKEN: ${{ secrets.PKG_TOKEN }}
     steps:
       - name: 检出代码
         uses: actions/checkout@v4