ci: make Gitea release runner workflow executable

.gitea/workflows/release.yml

@@ -8,6 +8,12 @@ on:
     tags:
       - 'v*'
 
+# Built-in Gitea token needs write access for release assets and package registry.
+permissions:
+  contents: read
+  releases: write
+  packages: write
+
 jobs:
   release:
     runs-on: [self-hosted]
@@ -20,7 +26,18 @@ jobs:
           python-version: '3.12'
 
       - name: Install build dependencies
-        run: pip install build nfpm
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y rpm python3-venv
+          python3 -m venv /tmp/fenris-ci
+          /tmp/fenris-ci/bin/pip install --quiet build
+          echo "/tmp/fenris-ci/bin" >> "$GITHUB_PATH"
+          NFPM_VERSION=2.47.0
+          curl --fail --silent --show-error --location \
+            "https://github.com/goreleaser/nfpm/releases/download/v${NFPM_VERSION}/nfpm_${NFPM_VERSION}_Linux_x86_64.tar.gz" \
+            -o /tmp/nfpm.tar.gz
+          sudo tar -xzf /tmp/nfpm.tar.gz -C /usr/local/bin nfpm
+          nfpm --version
 
       - name: Build packages
         run: make package