Update CI pipeline to use refresh token for pub.dev auth

Uses PUB_DEV_REFRESH_TOKEN secret to authenticate with pub.dev.
The refresh token is long-lived and auto-renews the access token.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/publish.yml

@@ -38,9 +38,6 @@ jobs:
         with:
           go-version: '1.23'
 
-      - name: Install Xcode tools
-        run: xcode-select --install 2>/dev/null || true
-
       - name: Build xcframework from Go source
         run: |
           chmod +x build_go.sh
@@ -51,10 +48,21 @@ jobs:
           ls -lh ios/TailscaleKit.xcframework/ios-arm64/TailscaleKit.framework/TailscaleKit
           ls -lh ios/TailscaleKit.xcframework/ios-arm64-simulator/TailscaleKit.framework/TailscaleKit
 
+      - name: Write pub.dev credentials
+        run: |
+          mkdir -p "$HOME/Library/Application Support/dart"
+          cat > "$HOME/Library/Application Support/dart/pub-credentials.json" <<EOF
+          {
+            "accessToken": "initial",
+            "refreshToken": "${{ secrets.PUB_DEV_REFRESH_TOKEN }}",
+            "tokenEndpoint": "https://accounts.google.com/o/oauth2/token",
+            "scopes": ["openid", "https://www.googleapis.com/auth/userinfo.email"],
+            "expiration": 0
+          }
+          EOF
+
       - name: Dry run publish
         run: dart pub publish --dry-run
 
       - name: Publish to pub.dev
         run: dart pub publish --force
-        env:
-          PUB_TOKEN: ${{ secrets.PUB_TOKEN }}