fix: Push to public mirrors after merge (#614)

Add fire-and-forget mirror push support so merges to the primary branch
are automatically pushed to configured public mirrors (GitHub, Codeberg,
etc.). Mirror failures are logged but never block the pipeline.

- lib/mirrors.sh: new shared mirror_push() helper
- lib/load-project.sh: parse [mirrors] TOML section into MIRROR_* env vars
- dev/phase-handler.sh: call mirror_push after do_merge() success
- dev/dev-poll.sh: call mirror_push after try_direct_merge() success
- gardener/gardener-run.sh: call mirror_push after _gardener_merge() success
- bin/disinto: set up mirror remotes during init, add commented mirrors to
  generated TOML
- projects/*.toml.example: show [mirrors] section (commented out)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

lib/mirrors.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# mirrors.sh — Push primary branch + tags to configured mirror remotes.
+#
+# Usage: source lib/mirrors.sh; mirror_push
+# Requires: PROJECT_REPO_ROOT, PRIMARY_BRANCH, MIRROR_* vars from load-project.sh
+
+# shellcheck disable=SC2154  # globals set by load-project.sh / calling script
+
+mirror_push() {
+  [ -z "${MIRROR_NAMES:-}" ] && return 0
+  [ -z "${PROJECT_REPO_ROOT:-}" ] && return 0
+  [ -z "${PRIMARY_BRANCH:-}" ] && return 0
+
+  local name url
+  for name in $MIRROR_NAMES; do
+    url=$(eval "echo \"\$MIRROR_$(echo "$name" | tr '[:lower:]' '[:upper:]')\"") || true
+    [ -z "$url" ] && continue
+
+    # Ensure remote exists with correct URL
+    if git -C "$PROJECT_REPO_ROOT" remote get-url "$name" &>/dev/null; then
+      git -C "$PROJECT_REPO_ROOT" remote set-url "$name" "$url" 2>/dev/null || true
+    else
+      git -C "$PROJECT_REPO_ROOT" remote add "$name" "$url" 2>/dev/null || true
+    fi
+
+    # Fire-and-forget push (background, no failure propagation)
+    git -C "$PROJECT_REPO_ROOT" push "$name" "$PRIMARY_BRANCH" --tags 2>/dev/null &
+    log "mirror: pushed to ${name} (pid $!)"
+  done
+}