Cover materialized fallback and add a CLI smoke test for --all-refs

The two existing AllRefs integration tests both hit bootstrap (empty target). For non-empty targets, RefKindOther refs fail CanIncrementalRelay by design and fall through to the materialized executor — a code path that's kind-agnostic on push but had no end-to-end coverage with AllRefs. The new test pre-populates the target with the branch, adds a refs/notes/commits ref on source, and asserts: result.Pushed=1 (notes create only, branch is a skip), result.Relay=false (materialized, not relay), and the notes ref lands on target at the right hash.

The CLI smoke test goes through cmd/git-sync's cobra entry via run(...) with --all-refs --json, then walks the JSON for the notes ref entry to confirm kind=other and action=create. This pins the full pipeline (flag parsing → unstable client → bridge → syncer → receive-pack) against silent regressions where individual layers compile but the wiring breaks.