fix: add bun install step and bunx/npx tool patterns to upstream-sync

Two fixes for the upstream-sync Claude workflow:

1. Add Bun install + bun install (deps) steps before Claude runs,
   so tsc, prettier, and other devDependencies are available.
   Previously node_modules/.bin/ didn't exist and typecheck/format
   commands failed with "command not found".

2. Add Bash(bunx:*), Bash(npx:*), Bash(./node_modules/.bin/*:*)
   to allowed_tools. The existing Bash(bun:*) only covers the `bun`
   binary, not `bunx` which is a separate binary.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.forgejo/kcl-ci/main.k

@@ -290,6 +290,9 @@ _upstream_sync_workflow = {
         ]
         workflow_dispatch = {}
     }
+    env = {
+        BUN_VERSION = _BUN_VERSION
+    }
     jobs = {
         "check-upstream" = {
             name = "Check for upstream updates"
@@ -532,6 +535,8 @@ else
   echo "Merge has conflicts — Claude will resolve them"
 fi"""
                 }
+                _bun_install()
+                _bun_deps()
                 {
                     name = "Claude: review merge and create PR"
                     uses = _claude_action_url
@@ -541,7 +546,7 @@ fi"""
                         github_token = h.gha_secret("CLAUDE_BOT_TOKEN")
                         platform = "forgejo"
                         show_full_output = "true"
-                        allowed_tools = "Bash(git:*),Bash(bun:*),Bash(curl:*),Read,Write,Edit,MultiEdit,Glob,Grep,WebFetch,WebSearch"
+                        allowed_tools = "Bash(git:*),Bash(bun:*),Bash(bunx:*),Bash(npx:*),Bash(./node_modules/.bin/*:*),Bash(curl:*),Read,Write,Edit,MultiEdit,Glob,Grep,WebFetch,WebSearch"
                     }
                     env = {
                         GITHUB_TOKEN = h.gha_secret("CLAUDE_BOT_TOKEN")