Address review: unborn HEAD is a cross-check, not evidence of emptiness

The converged path rested on a false reading of the protocol. unborn HEAD means only that HEAD's symref target does not exist; it says nothing about whether other refs exist. Verified against git 2.53: a repository holding refs/heads/other with HEAD pointed at a never-created refs/heads/main reports unborn, and hiding that branch with uploadpack.hideRefs reduces its entire advertisement to the unborn line alone — exactly the input the previous commit treated as proof of an empty repository.

No client-side fix exists. Ref hiding is designed to be invisible to the client, so a hidden ref and an absent one are the same observation, and no combination of ls-refs arguments distinguishes them. "This repository has no refs" is therefore not a client-observable fact, and git-sync must stop claiming to establish it.

So the assertion becomes an input. SyncPolicy.SourceAssertedEmpty carries the caller's authoritative answer, from a repository-state query that sees past hiding, and git-sync's role is reduced to refusing to act on it unless everything git CAN observe agrees: nothing advertised, HEAD reported unborn, and no advertised ref name dropped as invalid. Every one of those can only refuse — none can promote an absent assertion into a success — so a caller that supplies nothing gets ErrSourceEmptyUnverified however the wire reads.

That closes a second instance of the same hole the review did not mention: ref-name validation dropping every advertised name (the new PartitionRefNames path) also leaves the ref set empty while unborn still fires, so RefService.SkippedRefNames is now surfaced and a non-empty one refuses.

SourceUnborn is renamed HeadUnborn, because the old name asserted the conclusion rather than the observation, and its doc now says what the line does and does not prove.

Also fixes the dry-run flag being dropped from the zero-plan success, so a replicate-mode plan of two empty repositories no longer reports execution.dryRun=false, with a regression test.

Tests cover the review's cases: unborn alongside another branch decodes as both facts and never lets one imply the other; an asserted-empty source whose HEAD is born, or that cannot report unborn at all, or whose names were dropped as invalid, all fail closed to unverified against both an empty and a populated target.