Keep the elected tracking ref current and match SSH host aliases

A push through an equivalent remote (an Entire mirror of the elected GitHub repository) delivered checkpoints that entire status and the gated-sync hint still counted as unpushed, because only the pushed remote's tracking ref moved. After a delivered branch push, the elected remote's tracking ref is now fast-forwarded to match; a non-fast-forward is left for the next fetch.

Repository identity moves to gitremote.Repository, and gitremote.ResolveRepository also resolves SSH host aliases through ssh -G when git runs plain ssh, so git@github-work:o/r matches git@github.com:o/r. A custom ssh command may read another config, so its aliases stay unmatched. effectiveSSHCommand moves to gitremote so both callers share one copy.

Mirror push-through of checkpoint refs (entire/checkpoints/v1 and refs/entire/*) is recorded as a verified external contract in the code and the implementation reference, since CI cannot exercise it.