fix: enable verbose output and full tool access for Claude workflows

- Add show_full_output: true to both claude.yml and upstream-sync.yml
- Add allowed_tools (Bash, Read, Write, etc.) to upstream-sync merge step
- Upgrade kcl-ci to v1.37.0 (defaults show_full_output and full tools)

Fixes: Claude was burning 38 turns hitting sandbox permission denials
trying to run bun test and git push during upstream sync.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.forgejo/kcl-ci/kcl.mod

@@ -4,4 +4,4 @@ edition = "v0.12.3"
 version = "0.0.1"
 
 [dependencies]
-kcl-ci = { git = "https://git.wxs.ro/actions/kcl-ci", tag = "v1.34.3" }
+kcl-ci = { git = "https://git.wxs.ro/actions/kcl-ci", tag = "v1.37.0" }