feat: add mirror branch workflow for Codeberg sync

Adds a mirror-branch workflow that copies main to a `codeberg` branch
excluding .forgejo/ and prds/ directories. Configure Forgejo push mirror
on this branch to sync a clean copy to Codeberg.

Also picks up updated allowed_tools from kcl-ci (adds bunx/npx patterns).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.forgejo/kcl-ci/main.k

@@ -3,6 +3,7 @@ import kcl_ci.schemas.config as cfg
 import kcl_ci.steps.checkout as checkout_mod
 import kcl_ci.workflows.kcl_ci_build as kcl_build_mod
 import kcl_ci.workflows.claude as claude_mod
+import kcl_ci.workflows.mirror_branch as mirror_mod
 import kcl_ci.versions
 
 # =============================================================================
@@ -663,6 +664,17 @@ fi"""
     }
 }
 
+# =============================================================================
+# Mirror branch workflow (syncs clean copy to Codeberg via push mirror)
+# Excludes internal CI config and development history
+# =============================================================================
+_mirror_config = mirror_mod.MirrorBranchConfig {
+    target_branch = "codeberg"
+    exclude_paths = [".forgejo", "prds"]
+    paths_ignore = [".forgejo/kcl-ci/**", "prds/**"]
+}
+_mirror_workflow = mirror_mod.mirror_branch_workflow(_mirror_config)
+
 # =============================================================================
 # Write workflows
 # =============================================================================
@@ -671,3 +683,4 @@ h.dump_workflow(_kcl_build_workflow, "../workflows/kcl-ci-build.yml")
 h.dump_workflow(_ci_workflow, "../workflows/ci.yml")
 h.dump_workflow(_test_action_workflow, "../workflows/test-action.yml")
 h.dump_workflow(_upstream_sync_workflow, "../workflows/upstream-sync.yml")
+h.dump_workflow(_mirror_workflow, "../workflows/mirror-branch.yml")