Close native temper-app git e2e gaps

[nerdsane]

Summary

• add delta and thin-pack support to the streaming pack parser, including external base resolution from Temper-native object storage
• make receive-pack handle delete-only pushes, deterministic object/ref Ids, legacy ref entity addressing, and raw blob ingest responses
• propagate resolved principal scopes through WASM git modules and add the narrow internal Ref policy bridge
• rebuild receive-pack and upload-pack WASM artifacts
• bump the Temper submodule to the companion native-streaming fixes in Support native git streaming gaps temper#177

Empirical coverage

• pushed a temper-app-shaped repo with app.toml, docs, specs, policies, wasm assets, and a 300 KB blob into a fresh Temper-native server
• cloned it back and verified HEAD, tree parity, git fsck --strict, and clean working tree
• verified idempotent push, feature branch push using a thin pack, branch deletion, and final clone with only main remaining

Verification

• cargo test -p tg-wire --lib delta
• cargo test -p tg-wire --test git_pack_parity parse_pack_from_default_delta_and_large_blob_repo
• cargo check -p git_upload_pack -p git_receive_pack --target wasm32-wasip1
• cargo test -p temper-wasm http_stream
• cargo test -p temper-authz
• cargo test -p temper-server test_blob_ingest_raw_route_streams_body_without_path_param
• cargo test -p temper-server test_post_entity_creation_uses_odata_id_property
• cargo check -p temper-authz -p temper-server -p temper-wasm
• git diff --check in both workspaces