Fix blocking issues in convert-sha256

Submodule gitlinks: drop the "vendored" carve-out. Even when the linked-to commit lives in the source store, rewriting the gitlink to SHA256 produces a tree that fsck-passes but breaks git submodule update forever — the .gitmodules upstream still advertises only SHA1. Refuse any submodule gitlink in discoverReachable; keep a defensive guard in translateTree.

--check HEAD on tag-only conversions: pickHEAD returns "" when no branches landed, so HEAD stays at the PlainInit default refs/heads/master and the HEAD check guarantees a failure after an otherwise successful run. runChecks now takes a hasBranches bool and marks HEAD as skipped when false, with a "tags-only conversion" detail.

Partial signed-tags list dropped on error: signBranchTips returns the tags it created before failing, but Run was assigning res.SignedTags = signed only on the success path and the cobra wrapper dropped result entirely on err. Assign res.SignedTags before the err check, and have the cobra wrapper print the partial result on error so users see which converted/* tags landed and need cleanup.

--keep-source-objects on error paths: the flag's whole purpose is debugging failed conversions, but cleanupTemp was only flipped at the end of Run, so every error before that wiped the temp store. Hoist the cleanupTemp = false / res.TempDir assignment to right after MkdirTemp, and propagate res through every subsequent error return so the kept path surfaces in both Result and Lines() output.