v0.33.0 — mirrors stop pretending to accept contributions

Breaking: archive.yml's secrets are renamed wayback_access_key ->
archiveorg_access_key and wayback_secret_key -> archiveorg_secret_key. The pair
is an account credential signing Save Page Now, the S3 upload API and the
metadata API alike; naming it after one caller made every other use look like it
needed its own key. Callers passing the old names fail at startup.

New issue-pull.yml copies issues opened on the Codeberg and GitLab mirrors into
GitHub and closes the copy when the original closes, noting where it was closed,
how many comments it drew and how long it was open. It only reads the mirrors and
writes here, so no GitHub credential leaves the runner.

git-mirror.yml now turns pull requests off on the mirrors by default. A mirror is
force-pushed from its source, so anything merged on one is destroyed by the next
sync, and unlike GitHub neither platform can refuse a PR -- so the button comes
off instead. Issues and forking stay on. Its description prefix also defaults to
empty now.

archive.yml uploads the repository to archive.org as a browsable item with real
metadata, skipping when the recorded source revision already matches HEAD and
capping new-item creation per day. Save Page Now handling is fixed in three
places: a 404 under load is retryable, hitting the per-URL daily cap counts as
archived, and the retry budget now outlasts the queue instead of racing it.

Also: docker-image-workflow.yml's target_platforms is no longer both required and
defaulted, five workflows gained a top-level permissions block, and the README is
rewritten against the code.