Add POST /git/push for leased branch publication

[nishu-builder]

Add POST /git/push {destination, commit, branch, expected}. Validate commit availability and fast-forward ancestry, then make one Git push with an explicit destination lease. Creates and fast-forwards are the only supported updates.

Return typed completion, rejection or uncertainty. Missing source/expected commits and non-fast-forward updates have distinct error codes; porcelain ref status distinguishes receiver rejection from an unconfirmed response. Serialize duplicate pushes to a branch across servers sharing the store.

The endpoint does not import, merge, scan source files or conversation ancestry, or perform follow-up lookups. The HTTPS fixture covers leased creation/advancement, concurrent requests, stale/racing leases, receive-hook rejection and credential redaction, lost replies, and exact-commit transfer.

Validation on EC2: Nix build passed. The salted suite passed 46/47 checks in 395s; its Clippy findings were fixed, and Clippy passed on all affected crates with --all-targets -- -D warnings. Formatting passed after those lint-only fixes. HTTPS import/push, shallow-locator/offline-cache, and focused unit checks also passed. The functional suite was not repeated for the lint-only changes.

[nishu-builder]

Layer 3/8. The endpoint shape matches the design: required-but-nullable expected (with a unit test for the three cases), check-ref-format plus the leading-dash guard, G3 ancestry only when G3 exists, --force-with-lease=<ref>:<E> with the empty lease meaning create-only, push.followTags=false, and the observe-after-failure ladder. The fixture's racing lease, lost reply and 4-way concurrent push are the right tests, and the "no rev-list" assertion pins the "do not re-walk the closure" promise.

One finding I would fix before merging, inline at the post-failure branch: definite receiver-side rejections (read-only token, branch protection, archived repo) are reported as uncertain, and the design's "inspect before continuing" cannot resolve them because the branch is legitimately unchanged. --porcelain puts the ! [remote rejected] status on stdout, which is safe to parse with stderr still nulled.

Two nits inline: the fast-forward 422 also covers "E is not stored", and the shared marker check dropped the file/line listing the host path used to report.

---

Generated by Claude Code