Fix three review findings on --all-refs

replicate --all-refs no longer enables BestEffort. Bundling them contradicts replicate's "target == source" contract — a host rejecting refs/pull/* would leave the target incomplete while replicate exited successfully. allRefsFlag now takes a per-command implications list; sync/bootstrap include BestEffort, replicate doesn't. Added a CLI smoke test that hooks the target receive-pack to ng every ref and verifies: replicate --all-refs errors, sync --all-refs warns and exits 0. The help text also splits per command (best-effort vs strict).

replicateCanBootstrap missed AllRefs other-kind refs in its prune check, so replicate could shortcut to bootstrap and silently leave stale refs/notes/* on target. Added the matching case to mirror the prune-candidate logic in planner. Added an integration test that seeds a stale notes ref on target and asserts replicate --prune --all-refs deletes it.

The same test surfaced a pre-existing latent bug: runReplicate gated the executeReplicate call on len(relayPlans) > 0, so delete-only plans (no source-side updates) were silently skipped — even though replicate.Execute itself handles delete-only correctly. The gate is now len(pushPlans) > 0; the CanReplicateRelay check is only run when there are relay plans to validate. Existing replicate-prune test still passes.

CLI --all-refs now also implies --tags for sync and bootstrap so the help text "every refs/*" is honest. Library callers keep the three flags (AllRefs, IncludeTags, BestEffort) orthogonal. Docs updated to describe the per-command bundling and the deliberate decoupling for replicate.