v0.8.7 - send push base and handle non-fast-forward rejection

[0.8.7] - 2026-09-04

In plain terms: deltix push used to accept a push even when someone
else had already pushed newer work to the same repository in the meantime —
and that could quietly overwrite or orphan their commits with zero warning,
exactly what git protects against. Now the push behaves like git: it sends the
server the point it last pulled from, and if the remote has advanced beyond
that, the server refuses the push and deltix push clearly tells you to
deltix pull first. No more silent data loss on a shared repo.

Changed

• deltix push now sends a push base (from) to the server — the remote
  head it last pulled from (the persisted server head from .deltix-sync-state,
  falling back to the local origin/main ref). The server compares that against
  its own main head and rejects a non-fast-forward push with a 409.
• New NonFastForwardError surfaced as a clear message — "the remote has
  advanced. Run deltix pull first" — instead of the push silently applying.

Tests

• Unit suite passes: 131 tests, 0 failures (push service now forwards from).
• The shared round-trip integration test could not be run in this environment
  (the local Bun shell mis-parses the --author=deltix <deltix@deltix.local>
  redirect in the test harness — unrelated to this change). The new push-guard
  logic itself is covered by the server's own unit suite: matching from
  accepted, stale from rejected with NonFastForwardError, and absent from
  accepted for backwards compatibility.