fix(ci): Publish features with the package PAT (#8)

The surviving GHCR package rejects the workflow token. The publish action reads GITHUB_TOKEN from the step environment, so point that at the refreshed GH_TOKEN secret.

fix(ci): Missing GH token