sha256convert: dedup message-rewrite path; fix package doc and lints

Address a batch of PR #66 review findings:

• Merge extractMessageReferences + rewriteHashesInMessage into a single rewriteMessageRefs that resolves and rewrites a commit/tag message in one regex pass. The "translate referenced objects before rewriting" ordering -- the subtlest invariant in the file -- now lives in one place instead of two byte-identical copies, and the message body is scanned once per object instead of twice.

• Extract stripSignatures and previewJoin helpers to collapse the remaining copy-paste in translateCommit/translateTag and Result.Lines (the two preview blocks had already drifted: one said "full list in --json", the other didn't).

• Package doc no longer claims "no hash mapping is persisted": the SHA1->SHA256 mapping is preserved by default via refs/notes/sha1-origin and optionally via --write-mapping, so the originals stay recoverable.

• Make the target-dir failure cleanup best-effort (no returned error), matching the temp-dir cleanup defer. This clears the errcheck and wrapcheck findings golangci-lint flagged on the cleanup helpers, and the exhaustive switch case in rewriteMessageRefs.