The Actions release pushes with its publish token alone. actions/checkout left the job's own token in git's config for g1t.sh, so each push sent it beside the publish token, and g1t took the job's, which may only write this repository: the release created g1t/deploy and was then refused pushing to it. The checkout keeps no credentials now.
