Discover target HEAD via concurrent upload-pack info-refs

receive-pack advertisements don't include HEAD (server-side go-git's addReferences passes addHead=false for forPush, matching real git servers). So the session now does a second info-refs against the target's upload-pack endpoint, runs it concurrently with the existing receive-pack info-refs, and parses HEAD's symref capability from the result.

Cost: one extra HTTP GET per session, parallelised with the existing target request → effectively zero added latency. Failures are non-fatal: push-only auth that 401s on upload-pack just leaves targetSession.headTarget empty.

gitproto.DiscoverHEAD wraps the v1 advertisement parse. The session goroutine swallows errors; future telemetry could surface them if useful.

Refs #45.