GITHUB_SERVER_URL on this runner is an internal cluster address using
http:// (e.g. http://forgejo-http.forgejo.svc.cluster.local:3000), not
the public https:// hostname -- stripping only "https://" left it
untouched and produced "https://http://...". Instead of guessing at
scheme/host, read the remote URL checkout already resolved (proven to
work, since fetch/clone succeeded) and inject tag-bot credentials into
it directly. Also set persist-credentials: false on checkout so its
own token credentials cannot conflict with ours.