Two workflow fixes:
- ci.yml: add explicit `pip install ruff` before lint step; also add
freeze/** to push trigger so RC branches run CI
- mirror.yml: rename GITHUB_MIRROR_TOKEN → GH_MIRROR_TOKEN to match
org-level secret; Forgejo reserves the GITHUB_* prefix so that name
was silently shadowed, causing mirror pushes to fail with auth errors