fix: enable verbose output and full tool access for Claude workflows

- Add show_full_output: true to both claude.yml and upstream-sync.yml
- Add allowed_tools (Bash, Read, Write, etc.) to upstream-sync merge step
- Upgrade kcl-ci to v1.37.0 (defaults show_full_output and full tools)

Fixes: Claude was burning 38 turns hitting sandbox permission denials
trying to run bun test and git push during upstream sync.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.forgejo/workflows/claude.yml

@@ -1,4 +1,4 @@
-# Generated by KCL v1.34.3 - DO NOT EDIT
+# Generated by KCL v1.37.0 - DO NOT EDIT
 # Source: .forgejo/kcl-ci/main.k
 # kcl-ci local: ~/stuff/gitrepos/wxs/actions/kcl-ci
 # kcl-ci remote: https://git.wxs.ro/actions/kcl-ci
@@ -39,6 +39,8 @@ jobs:
         bot_email: claude@wxs.ro
         platform: forgejo
         assignee_trigger: claude
+        show_full_output: 'true'
+        allowed_tools: Bash,Read,Write,Edit,MultiEdit,Glob,Grep,WebFetch,WebSearch
     - name: Debug on failure
       if: failure()
       run: |

.forgejo/workflows/upstream-sync.yml

@@ -1,4 +1,4 @@
-# Generated by KCL v1.34.3 - DO NOT EDIT
+# Generated by KCL v1.37.0 - DO NOT EDIT
 # Source: .forgejo/kcl-ci/main.k
 # kcl-ci local: ~/stuff/gitrepos/wxs/actions/kcl-ci
 # kcl-ci remote: https://git.wxs.ro/actions/kcl-ci
@@ -281,6 +281,8 @@ jobs:
         claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
         github_token: ${{ secrets.CLAUDE_BOT_TOKEN }}
         platform: forgejo
+        show_full_output: 'true'
+        allowed_tools: Bash,Read,Write,Edit,MultiEdit,Glob,Grep,WebFetch,WebSearch
       env:
         GITHUB_TOKEN: ${{ secrets.CLAUDE_BOT_TOKEN }}
         FORK_MODIFIED_FILES: ${{ steps.prepare.outputs.fork_files }}