Add a deterministic Git.Push workflow effect

[taras]

Story

As a workflow author, I want Git.Push to publish the current named branch as an independently reconciled external effect, so PullRequest never hides or repeats remote mutation.

Initial contract

<Git.Push /> has no props and no public component return. It operates in the contextual Repository or Worktree established by lexical composition.

The initial effect publishes the exact current local commit to the same-named branch on the Repository's canonical primary remote:

• remote: origin;
• source: the current named branch's exact local SHA;
• destination: refs/heads/<current-branch>.

Push does not create or change upstream tracking. It never force-pushes. Upstream mutation and force behavior require later, explicit contracts.

Before the external attempt, Push freezes a durable request containing the retained Repository identity, origin, the full destination ref, and the source SHA. Its natural key is the Repository identity plus remote and destination ref. Credentials, checkout paths, capabilities, Git object contents, and raw provider responses are not durable inputs.

The trusted host supplies the selected Git-host provider with an opaque, invocation-scoped object-source attachment bound to the current retained Repository or Worktree. That attachment gives the provider authorized live access to the objects needed for this push, is authenticated against the durable Repository identity, and is neither exposed through public routing middleware nor retained or replayed.

The effect derives stable external identity from the WorkflowRun and expansion. On replay or uncertain completion it observes the remote ref: the requested SHA is compatible and is adopted, proven absence may be performed once, and another SHA or permanent ambiguity fails. Temporary unavailability remains retryable under the shared Git-host reconciliation contract.

The filtered reconciliation record is published through one Workspace transaction. No transaction is claimed across the Workspace and the remote Git host.

Acceptance

• Detached HEAD and an unnamed branch fail before remote mutation.
• The complete request is frozen before the first external observation.
• The retained Repository identity, remote origin, full destination ref, and local SHA are explicit in the effect inputs and filtered history.
• The natural key identifies the Repository, remote, and destination ref independently of credentials and host-local paths.
• The selected provider can read the current Git objects only through the authenticated invocation-scoped attachment; that attachment is unavailable to replay data and public middleware.
• Replaying a completed push performs no remote mutation.
• Interruption after a successful remote update reconciles and adopts the compatible remote SHA.
• A remote ref at another SHA fails without force, reset, merge, or rebase.
• Success, failure, cancellation, and replay leave local upstream tracking unchanged.
• A caller must opt into any future force or upstream-establishment behavior through a separate explicit contract.
• The filtered reconciliation result includes the Repository identity, remote, branch and full refspec, local SHA, observed remote SHA, and reconciliation outcome.
• PullRequest requires compatible pushed-head evidence and never performs a hidden push.
• specs/workflow-workspace-spec.md §7.4 is updated to say that the initial Push leaves upstream tracking unchanged. Its existing “no result” language is clarified as no public component return; the filtered reconciliation record remains durable.

Dependencies

• Add named Repository and Worktree composition #293 supplies Repository and Worktree context.
• Add deterministic local Git workflow effects #294 supplies the current named branch and exact local commit SHA. Push acts on that admitted SHA; commit-construction defects such as Keep repository configuration from changing a Git.Commit object’s encoding #489 are independent and do not block Push.
• Add shared external Git-host effect reconciliation #297 supplies shared external Git-host effect reconciliation.
• End goal: ✨ Compose and certify the supervised adversarial implementation workflow #181.

[taras]

Architecture note from #181 reorientation: push remains external reconciliation

Git.Push should remain separate from Git.Commit and PullRequest. It is an external effect because the remote ref cannot participate in the local SQLite/Workspace transaction.

isomorphic-git may implement push for browser/provider contexts, but it does not change the contract. On replay, a completed push performs no remote mutation. After interruption or uncertain completion, the provider observes the remote ref: compatible remote state is adopted, proven absence may be performed, and divergence fails without implicit force, reset, merge or rebase.

The filtered result should identify the remote, branch/refspec, local commit SHA, observed remote SHA and reconciliation outcome. PullRequest should depend on that explicit pushed-head evidence rather than performing a hidden push.