ci: drop the Gitea mirror-sync nudge

Superseded: the Hanzo GitHub App pushes a webhook, so the forge tracks GitHub
without a per-repo workflow. This file called git.hanzo.ai/api/v1/.../mirror-sync
— a Gitea API for a system we no longer drive — and would sit inert in every repo.

One mechanism, in one place, instead of ~350 copies of a cron.

.github/workflows/sync.yml

@@ -1,102 +0,0 @@
-name: sync
-
-# Carries pushed refs to git.hanzo.ai, the canonical forge, and does nothing
-# else: build, test and release run natively there.
-#
-# Repo-agnostic. owner/name come from ${{ github.repository }}, so this file is
-# dropped into every repo unchanged as .github/workflows/sync.yml and is the
-# only workflow GitHub is permitted to run.
-
-on:
-  push:
-    # '**' matches slashes; '*' does not, and would skip feature/foo.
-    branches: ['**']
-    tags: ['**']
-  workflow_dispatch:
-
-# Serialize per ref. Never cancel: a cancelled run drops that ref and nothing
-# reconciles it afterwards.
-concurrency:
-  group: sync-${{ github.ref }}
-  cancel-in-progress: false
-
-permissions:
-  contents: read
-
-jobs:
-  sync:
-    # .github/workflows is also on the forge's own workflow search path, so this
-    # file executes there too in any repo without .hanzo/workflows, where it
-    # would push the forge to itself. server_url is the forge's AppURL, which
-    # makes this the test for "running on GitHub".
-    if: github.server_url == 'https://github.com'
-    # GitHub-hosted on purpose. This is the one workflow that must run ON GitHub,
-    # and the self-hosted pool that used to serve it is retired — a job asking for
-    # it now queues forever against a label nothing answers. Carrying refs is a
-    # push, not a build, so it does not belong on the build fabric anyway: builds
-    # run natively on git.hanzo.ai, which is the whole point of this file.
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          fetch-tags: true
-          persist-credentials: false
-
-      - name: Push refs to git.hanzo.ai
-        env:
-          FORGE: https://git.hanzo.ai
-          GIT_TOKEN: ${{ secrets.GIT_TOKEN }}
-        run: |
-          set -euo pipefail
-
-          if [ -z "${GIT_TOKEN}" ]; then
-            echo "::error::GIT_TOKEN is unset, so this push never reached the canonical forge. Add the org secret."
-            exit 1
-          fi
-
-          REMOTE="${FORGE}/${GITHUB_REPOSITORY}.git"
-
-          # The forge reads the token from the basic-auth password and ignores
-          # the username. base64 of a secret is not masked automatically.
-          AUTH="$(printf 'x-access-token:%s' "${GIT_TOKEN}" | base64 -w0)"
-          echo "::add-mask::${AUTH}"
-          # Host-scoped, so the forge token is never sent to github.com.
-          git config --local "http.${FORGE}/.extraheader" "Authorization: Basic ${AUTH}"
-
-          # Reachability is the only transient failure here, so it is the only
-          # thing retried. ls-remote exits 0 on an existing empty repo and
-          # non-zero when the forge is down or the repo is absent.
-          ERR="$(mktemp)"
-          REACHED=""
-          for attempt in 1 2 3; do
-            if git ls-remote "${REMOTE}" >/dev/null 2>"${ERR}"; then
-              REACHED=1
-              break
-            fi
-            echo "forge probe failed (attempt ${attempt}/3): $(cat "${ERR}")"
-            if [ "${attempt}" -lt 3 ]; then
-              sleep $((attempt * 5))
-            fi
-          done
-          if [ -z "${REACHED}" ]; then
-            echo "::error::git.hanzo.ai is unreachable or ${GITHUB_REPOSITORY} does not exist there. $(cat "${ERR}")"
-            exit 1
-          fi
-
-          # Additive and fast-forward-only: no leading '+', no --force, no
-          # --prune, no --mirror. Tags go every run so a tag that missed its own
-          # event still lands; git refuses to move one that already differs.
-          REFS=('refs/tags/*:refs/tags/*')
-          case "${GITHUB_REF}" in
-            refs/heads/*) REFS+=("${GITHUB_REF}:${GITHUB_REF}") ;;
-          esac
-
-          # Not --atomic: a diverged ref must not hold back the refs that are
-          # clean. Rejections still fail the job.
-          if ! git push "${REMOTE}" "${REFS[@]}"; then
-            echo "::error::git.hanzo.ai rejected a ref for ${GITHUB_REPOSITORY}. The forge is canonical and is never force-updated from here; reconcile the diverged branch or tag by hand."
-            exit 1
-          fi