Add branch-cleanup task, fix taplo-lint pre-commit hook

- mise-tasks/branch-cleanup: delete merged local/remote branches via
  git + Forgejo API (1Password/env/flag token resolution)
- mise.toml: add uv (runs PEP 723 task scripts) and bat (ai-docs output)
- CLAUDE.md: re-point at AGENTS.md
- prek.toml: drop taplo-lint hook. It fetches the remote SchemaStore
  catalog, which the pinned (dormant) taplo CLI can no longer decode and
  which fails in sandboxed CI. check-toml still validates syntax and
  taplo-format still formats.
- .forgejo workflows / .gitea/template / dagger: minor resync

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.forgejo/workflows/build.yaml

@@ -28,7 +28,7 @@ jobs:
     runs-on: k8s
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Run repository checks
         run: |

.forgejo/workflows/release.yaml

@@ -124,7 +124,7 @@ jobs:
           echo "Building release: $VERSION"
 
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0