fix(ci): mirror — push refs/heads + refs/tags, not all refs

`git push --mirror` pushes everything under refs/* including refs/pull/*,
which GitHub rejects with "deny updating a hidden ref" — GitHub manages
its own refs/pull/N/head namespace and won't let outside pushers touch it.

Switching to `--all --prune --force` + `--tags --prune --force` scopes the
push to refs/heads/* and refs/tags/* only (same as the original lines)
while keeping --prune so branch/tag deletions still propagate.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/workflows/mirror-to-github.yml

@@ -15,4 +15,8 @@ jobs:
           git clone --mirror https://gitea.resolutionflow.com/chihlasm/resolutionflow.git repo
           cd repo
           git remote add github https://x-access-token:${{ secrets.GH_MIRROR_TOKEN }}@github.com/${{ secrets.GH_MIRROR_REPO }}
-          git push github --mirror
+          # --all + --tags scopes the push to refs/heads/* and refs/tags/*,
+          # avoiding refs/pull/* (which GitHub refuses with "deny updating a
+          # hidden ref"). --prune makes deletions on the Gitea side propagate.
+          git push github --all --prune --force
+          git push github --tags --prune --force