tether 0.1.0a8

Dataset namespaces: pins are tether.. and working branches tether.ws.....; gc never touches another dataset sharing a store. Operation log (.tether/ops.jsonl, per workspace) with tether ops, tether undo [ID | --to ID], and tether repair. tether upgrade brings a1..a7 datasets forward (renames refs in every store and rewrites history to match; fails closed). New entrypoints where the VCS half and the store half must agree: abandon (drops commits + the gc plan they free), restore KEY --from REV (per-object re-fork), forget-workspace. new --discard is required to reset a branch with uncommitted writes; a branch already at the pin is reused (no more Neon sibling per commit). status and ops flag dataset commits removed behind tether's back. Fixes: git pins fail when the remote push fails; Neon role out of identity; Neon API errors are BackendErrors; undeletable branches are planned as kept. BREAKING: [tether] version = 2 -- run tether upgrade on existing datasets.