fix(ci): clone GitHub mirror OUTSIDE the source tree (was self-including)

The sync workflow cloned the GitHub mirror into `./gh-mirror` (under the source
checkout), then rsync `./` -> `gh-mirror/` swept the `gh-mirror` directory back
into the destination, polluting the public mirror with a `gh-mirror/` subtree.

Clone to `${RUNNER_TEMP:-/tmp}/awc-gh-mirror` instead, and add a belt-and-suspenders
`--exclude='gh-mirror/'` so a future re-use of the old name can't recur. The next
sync will, via rsync --delete, also remove the polluted directory from GitHub.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TfzV5QvtPDz8LJS3Pu5VLT

.gitea/workflows/sync-github-mirror.yml

@@ -48,24 +48,26 @@ jobs:
           SRC_SHA="$(git rev-parse --short HEAD)"
 
           # Clone the GitHub mirror into a sibling working dir
-          git clone --depth=1 "https://x-access-token:${GH_MIRROR_TOKEN}@github.com/${GH_REPO}.git" gh-mirror
+          GH_DIR="${RUNNER_TEMP:-/tmp}/awc-gh-mirror"; rm -rf "$GH_DIR"; git clone --depth=1 "https://x-access-token:${GH_MIRROR_TOKEN}@github.com/${GH_REPO}.git" "$GH_DIR"
 
           # Mirror this checkout's tree into gh-mirror/ with the exclusions.
           # --delete drops files removed on the source; --exclude='.git' protects
           # both repos' .git dirs from rsync touching them.
+          # belt-and-suspenders exclude of the clone dir name in case anyone re-uses ./gh-mirror.
           rsync -a --delete \
             --exclude='.git' \
             --exclude='.gitea/' \
             --exclude='.claude/' \
             --exclude='blog/' \
             --exclude='handoff.md' \
+            --exclude='gh-mirror/' \
             --exclude='__pycache__/' \
             --exclude='*.pyc' \
             --exclude='tasks.json' \
             --exclude='.DS_Store' \
-            ./ gh-mirror/
+            ./ "$GH_DIR"/
 
-          cd gh-mirror
+          cd "$GH_DIR"
           git add -A
           if git diff --cached --quiet; then
             echo "no relevant changes for the mirror (source push only touched excluded paths); skipping"