feat: add mirror branch workflow for Codeberg sync

Adds a mirror-branch workflow that copies main to a `codeberg` branch
excluding .forgejo/ and prds/ directories. Configure Forgejo push mirror
on this branch to sync a clean copy to Codeberg.

Also picks up updated allowed_tools from kcl-ci (adds bunx/npx patterns).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.forgejo/kcl-ci/kcl.mod.lock

@@ -3,5 +3,3 @@
     name = "kcl-ci"
     full_name = "kcl-ci_0.0.1"
     version = "0.0.1"
-    url = "https://git.wxs.ro/actions/kcl-ci"
-    git_tag = "v1.37.1"

.forgejo/kcl-ci/main.k

@@ -3,6 +3,7 @@ import kcl_ci.schemas.config as cfg
 import kcl_ci.steps.checkout as checkout_mod
 import kcl_ci.workflows.kcl_ci_build as kcl_build_mod
 import kcl_ci.workflows.claude as claude_mod
+import kcl_ci.workflows.mirror_branch as mirror_mod
 import kcl_ci.versions
 
 # =============================================================================
@@ -663,6 +664,17 @@ fi"""
     }
 }
 
+# =============================================================================
+# Mirror branch workflow (syncs clean copy to Codeberg via push mirror)
+# Excludes internal CI config and development history
+# =============================================================================
+_mirror_config = mirror_mod.MirrorBranchConfig {
+    target_branch = "codeberg"
+    exclude_paths = [".forgejo", "prds"]
+    paths_ignore = [".forgejo/kcl-ci/**", "prds/**"]
+}
+_mirror_workflow = mirror_mod.mirror_branch_workflow(_mirror_config)
+
 # =============================================================================
 # Write workflows
 # =============================================================================
@@ -671,3 +683,4 @@ h.dump_workflow(_kcl_build_workflow, "../workflows/kcl-ci-build.yml")
 h.dump_workflow(_ci_workflow, "../workflows/ci.yml")
 h.dump_workflow(_test_action_workflow, "../workflows/test-action.yml")
 h.dump_workflow(_upstream_sync_workflow, "../workflows/upstream-sync.yml")
+h.dump_workflow(_mirror_workflow, "../workflows/mirror-branch.yml")

.forgejo/workflows/mirror-branch.yml

@@ -0,0 +1,54 @@
+# Generated by KCL v1.37.1 - DO NOT EDIT
+# Source: .forgejo/kcl-ci/main.k
+# kcl-ci local: ~/stuff/gitrepos/wxs/actions/kcl-ci
+# kcl-ci remote: https://git.wxs.ro/actions/kcl-ci
+
+name: Mirror Branch
+'on':
+  push:
+    branches:
+    - main
+    paths-ignore:
+    - '.forgejo/kcl-ci/**'
+    - prds/**
+  workflow_dispatch: {}
+concurrency:
+  group: mirror-${{ github.ref }}
+  cancel-in-progress: true
+env:
+  READ_REPO_TOKEN: ${{ secrets.READ_REPO_TOKEN }}
+jobs:
+  update-mirror:
+    name: Update Mirror Branch
+    runs-on: grunt
+    steps:
+    - name: Checkout code
+      uses: https://${{ secrets.READ_REPO_TOKEN }}@git.wxs.ro/xternal/checkout@v6.0.2
+      with:
+        fetch-depth: '0'
+        token: ${{ github.token }}
+    - name: Configure git credentials
+      run: |-
+        git config --local user.name "forgejo-actions[bot]"
+        git config --local user.email "forgejo-actions[bot]@git.wxs.ro"
+        # Clear checkout action's extraheader (read-only token)
+        git config --local --unset-all http.https://git.wxs.ro/.extraheader || true
+        # Set remote URL with write token
+        git remote set-url origin "https://token:${GITHUB_TOKEN}@git.wxs.ro/${{ github.repository }}.git"
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+    - name: Create mirror branch
+      run: |-
+        # Create or reset the mirror branch from current HEAD
+        git checkout -B codeberg
+
+        # Remove excluded paths
+        rm -rf .forgejo
+        rm -rf prds
+
+        # Commit and force-push
+        git add -A
+        git commit -m "mirror: $(git log -1 --format='%h %s' main) [skip ci]" || echo "No changes to commit"
+        git push origin codeberg --force
+      env:
+        GITHUB_TOKEN: ${{ github.token }}