repo mirror create: still detect suspension on empty existing mirrors

The empty-upstream skip returned before waitForMirrorClone, which is also where the repo-scoped token exchange runs — the only signal that surfaces a suspended placement. So an existing, suspended mirror with an empty upstream showed a success-style "nothing to clone" note instead of the operator resume guidance.

Split the post-create flow into finishMirrorCreate: an empty upstream still skips the HEAD-poll loop (an empty repo never advertises a HEAD, so polling would only spin to the timeout), but an existing empty placement now runs the token-exchange probe so suspension is diagnosed. A fresh create still skips both — it can't be suspended. A non-suspension probe error stays non-fatal, since the placement exists and is genuinely empty.

The probe and wait are injected so the branching is unit-tested in TestFinishMirrorCreate without the auth + control-plane stack.