fix: enable verbose output and full tool access for Claude workflows

- Add show_full_output: true to both claude.yml and upstream-sync.yml
- Add allowed_tools (Bash, Read, Write, etc.) to upstream-sync merge step
- Upgrade kcl-ci to v1.37.0 (defaults show_full_output and full tools)

Fixes: Claude was burning 38 turns hitting sandbox permission denials
trying to run bun test and git push during upstream sync.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.forgejo/kcl-ci/kcl.mod

@@ -4,4 +4,4 @@ edition = "v0.12.3"
 version = "0.0.1"
 
 [dependencies]
-kcl-ci = { git = "https://git.wxs.ro/actions/kcl-ci", tag = "v1.34.3" }
+kcl-ci = { git = "https://git.wxs.ro/actions/kcl-ci", tag = "v1.37.0" }

.forgejo/kcl-ci/kcl.mod.lock

@@ -4,4 +4,4 @@
     full_name = "kcl-ci_0.0.1"
     version = "0.0.1"
     url = "https://git.wxs.ro/actions/kcl-ci"
-    git_tag = "v1.34.3"
+    git_tag = "v1.37.0"

.forgejo/kcl-ci/main.k

@@ -540,6 +540,8 @@ fi"""
                         claude_code_oauth_token = h.gha_secret("CLAUDE_CODE_OAUTH_TOKEN")
                         github_token = h.gha_secret("CLAUDE_BOT_TOKEN")
                         platform = "forgejo"
+                        show_full_output = "true"
+                        allowed_tools = "Bash,Read,Write,Edit,MultiEdit,Glob,Grep,WebFetch,WebSearch"
                     }
                     env = {
                         GITHUB_TOKEN = h.gha_secret("CLAUDE_BOT_TOKEN")