Scope is push OR prune, not prune alone

BuildDesiredRefs' auto-discovery pass — tags, and other-kind names under AllRefs — sits outside the mapping/branch branch, so a mapping-scoped AllRefs request still mirrors refs/notes/* and tags. Prune is the narrower set: it skips both once Mappings is set. TargetScope.Manages delegated wholly to PruneTarget and so reported those refs out of scope, letting an empty source converge against a target holding refs the config actively mirrors.

Manages is now the union of the two halves, which is what its own doc always claimed ("would push to, or prune"). Exclusions still apply to the auto-discovery half, matching BuildDesiredRefs, and mapping targets still bypass them.

PruneTarget is deliberately left alone. Widening it would change what prune deletes, which is a live behaviour change well outside this branch — the asymmetry between push and prune scope under mappings is the planner's existing contract, not a bug this PR should quietly alter.

The previous revision of the mapping test asserted the wrong thing here: it expected an unmapped namespace to converge, by analogy with unmapped branches. Branches really are out of scope under mappings (the branch pass is in the else); other-kind refs are not. Both cases are now covered, along with the excluded-namespace counterpart that keeps the exclusion behaviour honest.