Implement fast-forward Pull, normal Push, and Publish Branch

[codeacme17]

Tracks #1.

Summary

Implement fast-forward-only Pull, exact-Upstream normal Push, and same-name Publish Branch with explicit targets and no history rewriting.

Scope

• Pull only from the displayed Local Branch Upstream and only from a clean Worktree with no Conflict or In-progress Git Operation.
• Enforce explicit fast-forward-only integration; ahead is a no-op and divergence is blocked without Merge/Rebase.
• Push only the current Local Branch to its exact configured Upstream ref.
• Allow Push with local uncommitted content while explicitly stating it is not included.
• Block known behind/diverged Push and never retry a rejection with force.
• Publish an unpublished Local Branch only after confirming exact Remote and same-name target; set Upstream after confirmed success.
• Revalidate Worktree/Branch/ref/Upstream target evidence before execution and run through the Repository remote lane.
• Use existing Git credential helpers and SSH; distinguish offline, auth, permission, policy/protected-Branch, non-fast-forward, Partial Success, and UnknownOutcome.
• Reconcile Local Branch, Remote-tracking refs, Upstream config, status, and operation result after every attempt.

Acceptance criteria

• Behind Pull fast-forwards; ahead Pull does nothing; diverged Pull changes no files/refs and routes safely to Terminal guidance.
• Push transfers only committed history to exactly the displayed Upstream; uncommitted content remains local.
• Publish confirms the exact target and configures Upstream only after verified success.
• No command uses force, force-with-lease, matching refs, tags, deletion, Merge, Rebase, or automatic retry.
• Auth/policy/non-fast-forward failures stay distinct and expose sanitized diagnostics.
• Concurrent remote operations return BUSY rather than queueing.

Out of scope

• Credential UI/setup, conflict resolution, force operations, remote Branch deletion, or generalized refspec entry.

Dependencies

• Implement versioned refresh, operation lanes, and reconciliation #7 and Implement Remote discovery and Fetch #13.

PRD coverage

• Pull/Push/Publish portions of FR7; AC-15–18 and AC-20–21.

Verification

• Local bare-remote fast-forward/divergence matrices, protected/rejected server fixtures, exact-ref assertions, cancellation/reconciliation tests, and redaction tests.