fix: enable verbose output and full tool access for Claude workflows

- Add show_full_output: true to both claude.yml and upstream-sync.yml
- Add allowed_tools (Bash, Read, Write, etc.) to upstream-sync merge step
- Upgrade kcl-ci to v1.37.0 (defaults show_full_output and full tools)

Fixes: Claude was burning 38 turns hitting sandbox permission denials
trying to run bun test and git push during upstream sync.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.forgejo/kcl-ci/kcl.mod.lock

@@ -4,4 +4,4 @@
     full_name = "kcl-ci_0.0.1"
     version = "0.0.1"
     url = "https://git.wxs.ro/actions/kcl-ci"
-    git_tag = "v1.34.3"
+    git_tag = "v1.37.0"