T8943: feat(mirror-rollout-2): adopt uniform wrapper stub (#33)

Per Mirror Pipeline Redesign Rollout 2: standardize the wrapper to the
canonical stub. Inclusion + kill-switch logic moves into the central
workflow + consumers.yaml; this wrapper is now a thin pass-through.

Changes from post-1b wrapper:
- branches: [rolling] -> [rolling, production] (broaden trigger for
  heterogeneous default-branch fleet; central + consumers.yaml gate the
  actual mirror)
- permissions: contents:write/pull-requests:write/issues:write ->
  contents:read (no side effects in wrapper; central workflow holds
  write perms via App tokens)
- Remove 'vars.MIRROR_ENABLED != false' gate from wrapper if: clause
  (kill-switch now enforced inside check-consumer-inclusion job +
  per-side-effect re-checks in process-unmirrored-PR)

Spec: ~/.claude/specs/2026-05-16-mirror-pipeline-redesign-design.md §4.2.3
Plan: ~/.claude/plans/2026-05-17-mirror-pipeline-rollout-2-inclusion-mechanism.md Task 6

🤖 Generated by [robots](https://vyos.io)

1 files changed, 2 insertions, 5 deletions

diff --git a/.github/workflows/pr-mirror-repo-sync.yml b/.github/workflows/pr-mirror-repo-sync.yml
index 5320e01..0f16633 100644
--- a/.github/workflows/pr-mirror-repo-sync.yml
+++ b/.github/workflows/pr-mirror-repo-sync.yml
@@ -6,7 +6,7 @@ name: PR Mirror and Repo Sync
 on:
   pull_request_target:
     types: [closed]
-    branches: [rolling]
+    branches: [rolling, production]
   workflow_dispatch:
     inputs:
       sync_branch:
@@ -14,16 +14,13 @@ on:
         type: string
 
 permissions:
-  contents: write
-  pull-requests: write
-  issues: write
+  contents: read
 
 jobs:
   call:
     if: |
       github.repository_owner == 'vyos'
       && (github.event.pull_request.merged == true || github.event_name == 'workflow_dispatch')
-      && vars.MIRROR_ENABLED != 'false'
     uses: vyos/.github/.github/workflows/pr-mirror-repo-sync.yml@production
     with:
       sync_branch: ${{ inputs.sync_branch || github.event.pull_request.base.ref }}