Add a deterministic Git.Push workflow effect

[taras]

Story

As a workflow author, I want Git.Push to publish the current named branch as an independently reconciled external effect, so PullRequest never hides or repeats remote mutation.

Contract

Git.Push operates in the contextual Repository or Worktree established by lexical composition. It pushes the current named branch to the configured primary remote and may establish its upstream. It never force-pushes implicitly.

The effect derives stable external identity from the WorkflowRun and expansion. On replay or uncertain completion it observes remote state: a compatible remote commit is adopted, proven absence is performed, and divergence or permanent ambiguity fails. Its local filtered result is recorded through one Workspace transaction, but no transaction is claimed across SQLite and the remote forge.

Acceptance

• Detached HEAD and an unnamed branch fail before remote mutation.
• The remote and refspec are explicit in the effect inputs and filtered history.
• Replaying a completed push performs no remote mutation.
• Interruption after a successful remote update reconciles the compatible remote SHA.
• Divergence fails without implicit force, reset, merge, or rebase.
• A caller must opt into any future force behavior through a separate explicit contract.
• The result includes the remote, branch, local SHA, observed remote SHA, and reconciliation outcome.
• PullRequest can require the compatible pushed head rather than performing a hidden push.

Dependencies

• Add named Repository and Worktree composition #293 supplies Repository and Worktree context.
• Add deterministic local Git workflow effects #294 supplies named branches and local commit effects.
• Add shared external forge-effect reconciliation #297 supplies shared external forge-effect reconciliation.
• End goal: Document adversarial implementation workflow WIP #181.