Add CLI tests for replicate subcommand and --force rejection

The existing CLI coverage only exercised replicate through 'plan --mode replicate'. This adds tests for the 'replicate' subcommand itself:

• End-to-end execution against an empty target, asserting the receive-pack POST happened, target head matches source, and the flat CLI JSON reports operation_mode=replicate plus relay=true with the bootstrap relay_reason
• --force rejection at the CLI layer, covering the 'use sync instead' guidance text users see when invoking the subcommand with an incompatible flag