fix: use Bash sub-patterns in upstream-sync for CI auto-approval

Bare `Bash` in allowed_tools makes the tool available but individual
commands still require interactive approval. In CI there's nobody to
approve, so git push, bun test, and curl all fail with
"Error: This command requires approval".

Changes:
- Switch to Bash(git:*), Bash(bun:*), Bash(curl:*) sub-patterns
- Add GITHUB_SERVER_URL env var so Claude doesn't need `export`
- Update prompt to reflect env var is pre-set

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.forgejo/kcl-ci/main.k

@@ -267,7 +267,7 @@ Prefer adapter patterns (separate Forgejo files) over inline modifications to up
 The fewer upstream files we modify, the fewer conflicts in the next sync.
 
 ## After merge is resolved and reviewed
-1. Run tests: export GITHUB_SERVER_URL=https://github.com && bun test
+1. Run tests: bun test (GITHUB_SERVER_URL is already set in the environment)
 2. Run typecheck: bun run typecheck
 3. Check formatting: bun run format:check — if issues, fix with bun run format
 4. Commit any remaining changes and push the branch
@@ -541,10 +541,11 @@ fi"""
                         github_token = h.gha_secret("CLAUDE_BOT_TOKEN")
                         platform = "forgejo"
                         show_full_output = "true"
-                        allowed_tools = "Bash,Read,Write,Edit,MultiEdit,Glob,Grep,WebFetch,WebSearch"
+                        allowed_tools = "Bash(git:*),Bash(bun:*),Bash(curl:*),Read,Write,Edit,MultiEdit,Glob,Grep,WebFetch,WebSearch"
                     }
                     env = {
                         GITHUB_TOKEN = h.gha_secret("CLAUDE_BOT_TOKEN")
+                        GITHUB_SERVER_URL = "https://github.com"
                         FORK_MODIFIED_FILES = h.gha_steps("prepare", "fork_files")
                         AFFECTED_FORK_FILES = h.gha_steps("prepare", "affected_files")
                     }

.forgejo/workflows/upstream-sync.yml

@@ -265,7 +265,7 @@ jobs:
           The fewer upstream files we modify, the fewer conflicts in the next sync.
 
           ## After merge is resolved and reviewed
-          1. Run tests: export GITHUB_SERVER_URL=https://github.com && bun test
+          1. Run tests: bun test (GITHUB_SERVER_URL is already set in the environment)
           2. Run typecheck: bun run typecheck
           3. Check formatting: bun run format:check — if issues, fix with bun run format
           4. Commit any remaining changes and push the branch
@@ -282,8 +282,9 @@ jobs:
         github_token: ${{ secrets.CLAUDE_BOT_TOKEN }}
         platform: forgejo
         show_full_output: 'true'
-        allowed_tools: Bash,Read,Write,Edit,MultiEdit,Glob,Grep,WebFetch,WebSearch
+        allowed_tools: Bash(git:*),Bash(bun:*),Bash(curl:*),Read,Write,Edit,MultiEdit,Glob,Grep,WebFetch,WebSearch
       env:
         GITHUB_TOKEN: ${{ secrets.CLAUDE_BOT_TOKEN }}
+        GITHUB_SERVER_URL: https://github.com
         FORK_MODIFIED_FILES: ${{ steps.prepare.outputs.fork_files }}
         AFFECTED_FORK_FILES: ${{ steps.prepare.outputs.affected_files }}