I've now added a branch protection rule for the github mirror, so that one can no longer push directly to it (so it's a true mirror now). The sageb0t user got an exemption so the sync from trac to the github mirror should still work (I've tested it for with a few commits).
Now if someone tries to push directly to the github mirror the following error message is shown
Let me know if you experience any issues with this setup and I'll try to fix it promptly.