Wire --all-refs into the CLI surface

Adds --all-refs to sync, plan, replicate, bootstrap, fetch, and probe. For sync/plan/replicate/bootstrap the flag bundles AllRefs scope with BestEffort policy: the broader ref discovery only earns its keep when hidden-ref refusals downgrade to warnings instead of tanking the run. Probe and fetch get AllRefs as scope-only (neither pushes), with a tailored flag description so the help text doesn't lie about "warnings".

The unstable BootstrapRequest grows a BestEffort field so the CLI's RunE can mirror the sync-side coupling. Library callers keep the two halves decoupled via RefScope.AllRefs and SyncPolicy.BestEffort.

docs/usage.md documents the --all-refs example, the strict/best-effort split, and adds "warned" to the JSON output keys list.