fix(ci): restore green CI — ruff install + mirror secret rename

Two workflow fixes:
- ci.yml: add explicit `pip install ruff` before lint step; also add
  freeze/** to push trigger so RC branches run CI
- mirror.yml: rename GITHUB_MIRROR_TOKEN → GH_MIRROR_TOKEN to match
  org-level secret; Forgejo reserves the GITHUB_* prefix so that name
  was silently shadowed, causing mirror pushes to fail with auth errors

.forgejo/workflows/ci.yml

@@ -7,7 +7,7 @@ name: CI
 
 on:
   push:
-    branches: [main, 'feature/**', 'fix/**']
+    branches: [main, 'feature/**', 'fix/**', 'freeze/**']
   pull_request:
     branches: [main]
 
@@ -29,6 +29,9 @@ jobs:
       - name: Install dependencies
         run: pip install -r requirements.txt
 
+      - name: Install lint tools
+        run: pip install ruff
+
       - name: Lint
         run: ruff check .
 

.forgejo/workflows/mirror.yml

@@ -1,6 +1,7 @@
 # Mirror push to GitHub and Codeberg on every push to main or tag.
 # Copied from Circuit-Forge/cf-agents workflows/mirror.yml
-# Required secrets: GITHUB_MIRROR_TOKEN, CODEBERG_MIRROR_TOKEN
+# Required secrets: GH_MIRROR_TOKEN, CODEBERG_MIRROR_TOKEN
+# Note: Forgejo reserves the GITHUB_* prefix for secret names — use GH_* instead.
 
 name: Mirror
 
@@ -19,10 +20,10 @@ jobs:
 
       - name: Mirror to GitHub
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_MIRROR_TOKEN }}
+          GH_MIRROR_PAT: ${{ secrets.GH_MIRROR_TOKEN }}
           REPO: ${{ github.event.repository.name }}
         run: |
-          git remote add github "https://x-access-token:${GITHUB_TOKEN}@github.com/CircuitForgeLLC/${REPO}.git"
+          git remote add github "https://x-access-token:${GH_MIRROR_PAT}@github.com/CircuitForgeLLC/${REPO}.git"
           git push github --mirror
 
       - name: Mirror to Codeberg