Address review: subsumed creates count only when confirmed; unexport push funcs

The subsumed path checked only for an explicit refusal, so RefOutcomeUnknown fell through to "finalized": against a target that reports no per-ref status, a subsumed create that silently did not land was recorded in completedRefs and counted in BatchCount. It now asks the same question the cutover asks — createConfirmed, not refRefused — so silence stops counting as delivery.

Settled locally rather than against a ref listing, and the comment now says why that is the right answer here rather than answering the scaffolding question instead: a subsumed branch has no temp ref to preserve, so all that hinges on it is the reported count and a have that trunk's own tip already covers. Neither is worth a round trip, and under-reporting work this run cannot confirm matches the direction taken everywhere else. Covered by a test that compares a silent target's BatchCount against a confirmed run's.

Nit, also from the review: pushPack, pushCommands and pushObjects took the unexported *pushStatusSink after the last round, so an external caller could only ever pass nil. There are none — the Pusher methods are the API — so they are unexported now, with their doc comments and one cross-reference updated to match.

Full suite green under -race, golangci-lint clean.

🤖 Generated with Claude Code