Add BestEffort policy and ActionWarn for per-ref reject downgrades

The receive-pack response is per-ref: the server can accept some refs and reject others in the same push (GitHub's hidden-ref refusals are the load-bearing case). Previously sendReceivePack treated any ng as a fatal error via report.Error(); this commit threads an OnRejection callback down through Pusher and the free Push* functions so callers can opt into receiving per-ref ng statuses without short-circuiting the push. Pack-level unpack failures stay fatal.

SyncPolicy.BestEffort wires that callback up at session construction. The session collects rejections in a map; after each strategy returns, applyRejections walks the plans and downgrades matching entries to a new ActionWarn with the server's reason in plan.Reason. Result.Warned counts the downgrades, complementing Pushed/Skipped/Blocked/Deleted, and the human-readable summary line surfaces it.

The integration test wires a target receive-pack hook that returns "deny updating a hidden ref" for refs/notes/commits while accepting the branch ref, runs with AllRefs+BestEffort, and asserts the notes plan ends up as ActionWarn with the reason carried through.