I respectfully believe this is an expectations issue. You say that you want to "syndicate carefully", but open-source software is basically the antithesis of that - allowing anyone to syndicate your code anywhere, outside of your control, restricted only by the terms of the OSS license.
When you search for something on Google, they return what they believe to be the most authoritative, relevant result for your query, not necessarily the original source of it. Google isn't smart enough yet to know for sure what the "official" or "original" source of a piece of information is, short of using a lot of educated guesses (first-seen date, backlinks, site authority), which can sometimes result in the wrong answer.
Even if Google were to know which repository/webpage were the "official" source for the info, it might have reasons to link to an alternate source that the algorithm perceives as more "usable" or "fresh" (e.g. a recently updated repo compared to an abandoned repo, a repo with less backlinks, a read-only archive, a repo on a less popular repo-hosting site, etc).
If this were proprietary code, the solution would be to DMCA takedown the unofficial copies of your code, either at the source or with Google. But since this code's license presumably allows it to be copied freely, you have no control over syndication, and what Google perceives as the most useful result may not be the official source.
Did we do something wrong with our repository browser, or with the mirror?
There's no reason to believe that, afaik. This rankings issue is a classic foray into the strange world of SEO.
My advice is to not worry too much about where searches of random files in your project take you. Your GitHub mirror is already the top result for "wikimedia puppet", which is what I'd expect most users to search first if they needed to look at the up-to-date version of any files in your repo.