Clarify GitOps token authorization scope

README.md

@@ -53,16 +53,19 @@ manually or by a dependency updater. They do not need a fake promotion repositor
 
 ## Gitea credentials
 
-Prefer owner- or organization-level Actions secrets so every maintained chart repository receives the same narrowly
-scoped credentials:
+Prefer owner- or organization-level Actions secrets when the same credentials should be shared with maintained chart
+repositories:
 
 - `PACKAGE_USERNAME` and `PACKAGE_TOKEN`: upload-only credentials for the `feedc0de` Helm package repository;
-- `GITOPS_TOKEN`: a token with `write:repository` access to only `feedc0de/homelab-gitops`;
+- `GITOPS_TOKEN`: a Gitea personal access token with `write:repository` scope, used to promote releases into
+  `feedc0de/homelab-gitops`;
 - `QUAY_USERNAME` and `QUAY_TOKEN`: required only by repositories that publish container images.
 
 The workflow commits as the normal `feedc0de` Git identity. The token determines authorization; the commit name is
-not a separate Gitea account. A dedicated promoter account is still preferable if a one-repository permission scope
-is desired.
+not a separate Gitea account. Note that Gitea's `write:repository` personal-token scope is user-wide, not restricted
+to one repository. The current chart-repo token can therefore write to any repository that `feedc0de` can write to.
+A dedicated promoter account with access only to `homelab-gitops` is the safer option if that narrower authorization
+boundary is wanted.
 
 ## Bootstrap and recovery