CD: fix ghcr push error

[casperdcl]

Docker images are being pushed to the org packages rather than repo packages. However the repo's default CI GITHUB_TOKEN lacks permissions to push to the org.

• label images appropriately label images #93
• create a machine user (bot) account
  • does it need org owner access (!) in order to push org packages? Can't find guidance in docs.
  • or manually give it access to all existing packages (there doesn't seem to be any API to do this via CLI)
• create PAT (docs currently say "classic" rather than "fine grained")
  • check whether "fine grained" actually works
  • necessary permissions
• update CI workflow to use said PAT

[tiero]

did you tried adding packages: write under permissions for the GH Action job?

[casperdcl]

yes that's already in main

prem-services/.github/workflows/ci.yml

Lines 56 to 57 in 8e4e2a3

	permissions:
	packages: write

but I believe only scoped to this repo rather than org :/