fix: add bun install step and bunx/npx tool patterns to upstream-sync

Two fixes for the upstream-sync Claude workflow:

1. Add Bun install + bun install (deps) steps before Claude runs,
   so tsc, prettier, and other devDependencies are available.
   Previously node_modules/.bin/ didn't exist and typecheck/format
   commands failed with "command not found".

2. Add Bash(bunx:*), Bash(npx:*), Bash(./node_modules/.bin/*:*)
   to allowed_tools. The existing Bash(bun:*) only covers the `bun`
   binary, not `bunx` which is a separate binary.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.forgejo/kcl-ci/main.k

@@ -290,6 +290,9 @@ _upstream_sync_workflow = {
         ]
         workflow_dispatch = {}
     }
+    env = {
+        BUN_VERSION = _BUN_VERSION
+    }
     jobs = {
         "check-upstream" = {
             name = "Check for upstream updates"
@@ -532,6 +535,8 @@ else
   echo "Merge has conflicts — Claude will resolve them"
 fi"""
                 }
+                _bun_install()
+                _bun_deps()
                 {
                     name = "Claude: review merge and create PR"
                     uses = _claude_action_url
@@ -541,7 +546,7 @@ fi"""
                         github_token = h.gha_secret("CLAUDE_BOT_TOKEN")
                         platform = "forgejo"
                         show_full_output = "true"
-                        allowed_tools = "Bash(git:*),Bash(bun:*),Bash(curl:*),Read,Write,Edit,MultiEdit,Glob,Grep,WebFetch,WebSearch"
+                        allowed_tools = "Bash(git:*),Bash(bun:*),Bash(bunx:*),Bash(npx:*),Bash(./node_modules/.bin/*:*),Bash(curl:*),Read,Write,Edit,MultiEdit,Glob,Grep,WebFetch,WebSearch"
                     }
                     env = {
                         GITHUB_TOKEN = h.gha_secret("CLAUDE_BOT_TOKEN")

.forgejo/workflows/upstream-sync.yml

@@ -8,6 +8,8 @@ name: Upstream Sync Check
   schedule:
   - cron: '0 8 * * 1'
   workflow_dispatch: {}
+env:
+  BUN_VERSION: '1.2.21'
 jobs:
   check-upstream:
     name: Check for upstream updates
@@ -230,6 +232,23 @@ jobs:
           echo "merge_clean=false" >> "$GITHUB_OUTPUT"
           echo "Merge has conflicts — Claude will resolve them"
         fi
+    - name: Install Bun
+      run: |-
+        if command -v bun &> /dev/null; then
+          INSTALLED=$(bun --version)
+          if [ "$INSTALLED" = "$BUN_VERSION" ]; then
+            echo "Bun $BUN_VERSION already installed"
+          else
+            echo "Bun $INSTALLED installed, need $BUN_VERSION — reinstalling"
+            curl -fsSL https://bun.sh/install | bash -s "bun-v${BUN_VERSION}"
+            echo "$HOME/.bun/bin" >> "$GITHUB_PATH"
+          fi
+        else
+          curl -fsSL https://bun.sh/install | bash -s "bun-v${BUN_VERSION}"
+          echo "$HOME/.bun/bin" >> "$GITHUB_PATH"
+        fi
+    - name: Install dependencies
+      run: bun install
     - name: 'Claude: review merge and create PR'
       uses: https://${{ secrets.READ_REPO_TOKEN }}@git.wxs.ro/actions/claude-code-action@main
       with:
@@ -282,7 +301,7 @@ jobs:
         github_token: ${{ secrets.CLAUDE_BOT_TOKEN }}
         platform: forgejo
         show_full_output: 'true'
-        allowed_tools: Bash(git:*),Bash(bun:*),Bash(curl:*),Read,Write,Edit,MultiEdit,Glob,Grep,WebFetch,WebSearch
+        allowed_tools: Bash(git:*),Bash(bun:*),Bash(bunx:*),Bash(npx:*),Bash(./node_modules/.bin/*:*),Bash(curl:*),Read,Write,Edit,MultiEdit,Glob,Grep,WebFetch,WebSearch
       env:
         GITHUB_TOKEN: ${{ secrets.CLAUDE_BOT_TOKEN }}
         GITHUB_SERVER_URL: https://github.com