This is covered by the git push documentation, although you need to know what you're looking at:
--mirror
Instead of naming each ref to push, specifies that all refs under
refs/ (which includes but is not limited to refs/heads/,
refs/remotes/, and refs/tags/) be mirrored to the remote
repository. Newly created local refs will be pushed to the remote
end, locally updated refs will be force updated on the remote end,
and deleted refs will be removed from the remote end.
(emphasis mine)
Git, of course, has no idea what refs were "deleted": it just assumes that if you don't have some ref, such as refs/heads/master, in your repository, it should tell the other repository to delete its ref. So:
remote: error: refusing to delete the current default branch 'refs/heads/master'.
This clearly means that your repository does not have a refs/heads/master, and your git push --mirror is therefore asking them (whoever they are) to delete theirs too. But they're programmed to refuse to delete whatever branch name is set as the default branch.
Remember that the default branch is the name they, whoever they are, will recommend that git clone check out at the end of the cloning process, should the person running git clone fail to supply a -b option. Most web hosting sites offer a way to set this name. Since you mention GitHub, consider using gh or their web API to set the default branch to something other than master to avoid the error. However...
You mention in a comment that:
this is an old repo and we still use master. same steps work fine from master branch, when I checkout to preprod branch it fails with the above error ...
This strongly suggests that the repository from which you are running git push has only one branch name. As such, your git push --mirror will delete all other branch names. If that's what you want, you're on the right track. If not, reconsider the use of --mirror in the first place.