fix: use Bash sub-patterns in upstream-sync for CI auto-approval

Bare `Bash` in allowed_tools makes the tool available but individual
commands still require interactive approval. In CI there's nobody to
approve, so git push, bun test, and curl all fail with
"Error: This command requires approval".

Changes:
- Switch to Bash(git:*), Bash(bun:*), Bash(curl:*) sub-patterns
- Add GITHUB_SERVER_URL env var so Claude doesn't need `export`
- Update prompt to reflect env var is pre-set

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.forgejo/kcl-ci/main.k

@@ -267,7 +267,7 @@ Prefer adapter patterns (separate Forgejo files) over inline modifications to up
 The fewer upstream files we modify, the fewer conflicts in the next sync.
 
 ## After merge is resolved and reviewed
-1. Run tests: export GITHUB_SERVER_URL=https://github.com && bun test
+1. Run tests: bun test (GITHUB_SERVER_URL is already set in the environment)
 2. Run typecheck: bun run typecheck
 3. Check formatting: bun run format:check — if issues, fix with bun run format
 4. Commit any remaining changes and push the branch
@@ -541,10 +541,11 @@ fi"""
                         github_token = h.gha_secret("CLAUDE_BOT_TOKEN")
                         platform = "forgejo"
                         show_full_output = "true"
-                        allowed_tools = "Bash,Read,Write,Edit,MultiEdit,Glob,Grep,WebFetch,WebSearch"
+                        allowed_tools = "Bash(git:*),Bash(bun:*),Bash(curl:*),Read,Write,Edit,MultiEdit,Glob,Grep,WebFetch,WebSearch"
                     }
                     env = {
                         GITHUB_TOKEN = h.gha_secret("CLAUDE_BOT_TOKEN")
+                        GITHUB_SERVER_URL = "https://github.com"
                         FORK_MODIFIED_FILES = h.gha_steps("prepare", "fork_files")
                         AFFECTED_FORK_FILES = h.gha_steps("prepare", "affected_files")
                     }