Complete issue #23 push safety and acceptance evidence

[dapi]

What changed

• reject every unresolved Git porcelain status, including the previously
  missed AA and DD cases
• reject a symlinked memory-bank/ parent as well as a symlinked .repo
• make preflight failures explain the corrective next step
• strengthen CLI help, default/custom upstream, dry-run immutability, unsafe
  path, invalid remote, and conflict coverage

Why

The completion audit for #23 found that two valid unmerged statuses could enter
the publication plan and that the acceptance evidence did not cover all named
safety boundaries. The feature package also required a live upstream PR result
before closure.

Impact

memory-bank-cli push now fails closed for every unresolved downstream
conflict and provides actionable recovery guidance for preflight failures.

Validation

• go test -count=1 -race ./...
• go vet ./...
• go run ./cmd/memory-bank-cli lint --repo-root .
• live dry-run against a clean dapi/memory-bank checkout with unchanged HEAD,
  branch, status, and upstream default SHA
• live dapi/memory-bank#76:
  targeted main, contained one managed path, left main unchanged, and was
  closed without merge with its temporary branch deleted

Closes #23 after the feature evidence and lifecycle documents are finalized in
this PR.