feat: add mirror branch workflow for Codeberg sync

Adds a mirror-branch workflow that copies main to a `codeberg` branch
excluding .forgejo/ and prds/ directories. Configure Forgejo push mirror
on this branch to sync a clean copy to Codeberg.

Also picks up updated allowed_tools from kcl-ci (adds bunx/npx patterns).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.forgejo/kcl-ci/kcl.mod.lock

@@ -3,5 +3,3 @@
     name = "kcl-ci"
     full_name = "kcl-ci_0.0.1"
     version = "0.0.1"
-    url = "https://git.wxs.ro/actions/kcl-ci"
-    git_tag = "v1.37.1"