refactor: internalize auth and cache token wiring in prepare flow

- Remove token and cache-token from public action inputs
- Always use github.token internally for downloads/push
- Read fixed cache token from VOCIFERATE_CACHE_TOKEN env
- Add explicit 'Resolve cache token' step before prepare/tag in
  prepare-release workflow and pass it via env

.gitea/workflows/prepare-release.yml

@@ -38,13 +38,17 @@ jobs:
       - name: Run tests
         run: go test ./...
 
+      - name: Resolve cache token
+        id: cache-token
+        run: echo "value=${GITHUB_SHA}" >> "$GITHUB_OUTPUT"
+
       - name: Prepare and tag release
         id: prepare
         uses: ./prepare
+        env:
+          VOCIFERATE_CACHE_TOKEN: ${{ steps.cache-token.outputs.value }}
         with:
           version: ${{ inputs.version }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          cache-token: ${{ github.sha }}
 
       - name: Summarize prepared release
         run: |