ci: add sync-to-github workflow to keep GitHub gitops mirror current

The Forgejo-hosted gitops repo is what Flux actually watches and where
every deploy commit lands, but nothing pushed those commits to the
GitHub mirror — it silently drifted ~80 commits behind. This mirrors
the existing GitHub->Forgejo sync pattern used in the app repos, just
reversed.

Requires a GITHUB_MIRROR_TOKEN repo secret in Forgejo (GitHub PAT with
push access to Traceworks2023/nxtgauge-gitops) — added manually since
secret values can't be set via this session.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.forgejo/workflows/sync-to-github.yaml

@@ -0,0 +1,37 @@
+name: sync-to-github
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: sync-to-github-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Configure Git
+        run: |
+          git config user.name "forgejo-actions[bot]"
+          git config user.email "forgejo-actions@ci.nxtgauge.com"
+
+      - name: Push to GitHub
+        env:
+          GITHUB_MIRROR_TOKEN: ${{ secrets.GITHUB_MIRROR_TOKEN }}
+        run: |
+          set -euo pipefail
+          git remote add github-mirror "https://Traceworks2023:${GITHUB_MIRROR_TOKEN}@github.com/Traceworks2023/nxtgauge-gitops.git" 2>/dev/null || \
+            git remote set-url github-mirror "https://Traceworks2023:${GITHUB_MIRROR_TOKEN}@github.com/Traceworks2023/nxtgauge-gitops.git"
+          git push github-mirror "HEAD:main"