fix(ci): rename GITHUB_MIRROR_TOKEN secret to GH_MIRROR_TOKEN

Forgejo reserves the GITHUB_* prefix for secret names — creating a secret
called GITHUB_MIRROR_TOKEN returns 'invalid secret name'.
Also rename the GITHUB_TOKEN step env var to GH_MIRROR_PAT to avoid
collision with the built-in Forgejo Actions context variable.

.forgejo/workflows/mirror.yml

@@ -1,6 +1,7 @@
 # Mirror push to GitHub and Codeberg on every push to main or tag.
 # Copied from Circuit-Forge/cf-agents workflows/mirror.yml
-# Required secrets: GITHUB_MIRROR_TOKEN, CODEBERG_MIRROR_TOKEN
+# Required secrets: GH_MIRROR_TOKEN, CODEBERG_MIRROR_TOKEN
+# Note: Forgejo reserves the GITHUB_* prefix for secret names — use GH_* instead.
 
 name: Mirror
 
@@ -19,10 +20,10 @@ jobs:
 
       - name: Mirror to GitHub
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_MIRROR_TOKEN }}
+          GH_MIRROR_PAT: ${{ secrets.GH_MIRROR_TOKEN }}
           REPO: ${{ github.event.repository.name }}
         run: |
-          git remote add github "https://x-access-token:${GITHUB_TOKEN}@github.com/CircuitForgeLLC/${REPO}.git"
+          git remote add github "https://x-access-token:${GH_MIRROR_PAT}@github.com/CircuitForgeLLC/${REPO}.git"
           git push github --mirror
 
       - name: Mirror to Codeberg