Simplify after fifth review: dedupe, fold tag/other walk, reuse helpers

Fifth review pass surfaced a few real wins after the obvious dedup opportunities had landed in earlier passes:

• planner.RefPrefixes now takes PlanConfig instead of three positional bools. Five call sites all passed the same triple; the new shape removes the footgun (was-it-includeTags-or-allRefs?).
• BuildDesiredRefs collapses the tag and other-kind walks into one iteration of sourceRefs under AllRefs+IncludeTags, instead of two full traversals. Saves a pass on Gerrit-style repos with many refs/changes/* or refs/notes/*.
• syncer.tallyActions extracted from finalizeCounts; bootstrapWithInputs now uses it instead of an open-coded recount loop and three lines of self-justifying comment.
• syncertest.SetRefAtBranch helper replaces 7+ copies of the resolve-head + SetReference + dual-fatal-check pattern across the AllRefs integration tests.
• syncertest.DenyRefsReport helper replaces 4 copies of the ng-status hook synthesis (3 in syncer integration, 2 in cmd CLI tests).
• The CLI test server's sideband-wrap now respects no-progress, mirroring the syncer test server's writeReceivePackReport behavior.
• Comment trims: normalizeAllRefs, addPruneCandidates, tailPhaseLabel, syncSession.rejections, and four CLI test docstrings.

Net: -59 lines, all tests still green.