Pin the batched cutover dropping its resume marker on a rejected create

Failing test, no fix. Batched bootstrap deletes its temp ref (refs/gitsync/bootstrap/heads/<branch>) immediately after the cutover push, on the strength of that push returning no error. Under BestEffort that inference is invalid: gitproto hands a per-ref "ng" to OnRejection and returns nil, so a target refusing the branch create leaves the branch absent and the resume marker deleted, with the run reporting success.

Every object pushed so far is then unreferenced on the target, so the next run has no fetch have to negotiate against and re-transfers the whole history -- on precisely the large repositories batching exists for.

The test applies the non-denied commands itself rather than using syncertest.DenyRefsReport: a non-nil report short-circuits the test server before it applies anything, which would leave the temp ref at the previous checkpoint and make the delete that follows carry a stale Old, hiding the bug behind a second failure.