Add caos push-git

[nishu-builder]

Add caos push-git --expected=<hash|absent>. Reuse import credentials and HTTP transport; preserve the pinned commit and destination in every receipt.

Render known server error codes instead of arbitrary response text. Local preparation failures exit before dispatch; after dispatch, a missing, malformed or unconfirmed response produces an uncertain receipt. The fixture covers publication, receiver/validation rejection and invalid local inputs.

Validation on EC2: Nix build passed. The salted suite passed 46/47 checks in 395s; its Clippy findings were fixed, and Clippy passed on all affected crates with --all-targets -- -D warnings. Formatting passed after those lint-only fixes. HTTPS import/push, shallow-locator/offline-cache, and focused unit checks also passed. The functional suite was not repeated for the lint-only changes.

[nishu-builder]

Layer 4/8. Small and does what it says: shared send, strict argument parsing, absent spelled explicitly, response shape validated before it is echoed, and the CLI cases in the fixture. Timeout raised to 960s while the server's own git call is capped at 300s, which is fine as long as that ordering is deliberate.

One inline comment: mapping every 422 to a single validation-rejected diagnostic throws away the distinction the server already makes (reserved .caos, markers, conversation commit, not-a-fast-forward, E not stored), and the agent's next action differs for each. A marked JSON body from the server would let the CLI surface the reason without trusting arbitrary proxy text.

---

Generated by Claude Code