Address final review: document what the no-prune route accepts, changelog it

Three items, one of which had already been overtaken by ec4a45fc.

RefRefused / TargetReportsRefStatus are gone, replaced by a single Pusher-side tri-state, so the doc-versus-code disagreement the review names no longer exists, and the probe it shows no longer reproduces: a target that cannot report per-ref status is now settled by the ref listing, and the marker is deleted once the branch is confirmed at the pushed hash. A stale reference to the removed field in the cutover comment is fixed.

What survives is the remark about permanence, and it is worth making explicitly: keepMarker now states that on the replicate and sync routes prune reaps a marker kept unnecessarily, on the bootstrap route nothing does, and against a target that neither reports per-ref status nor answers a listing it is permanent — accepted, in that order of harm, because a marker is inert scaffolding the resume route cannot act on while its branch exists, and a marker deleted in error costs a full re-import.

Changelog. Added an Unreleased section covering the fix and, separately, the exit-code change: a refused temp-ref update now fails the run even under --best-effort, where every other per-ref refusal is a warning, so a run against a target that blocks refs/gitsync/* moves from 0-with-warnings to non-zero. Called out for anyone alerting on exit codes.

The fixture located the packfile by scanning for "PACK". A ref named refs/heads/PACKAGING puts that literal in the command list and yields an offset inside it. Replaced with a walk of the pkt-line framing to the flush that ends the commands, which is exact; the request router's own hasPack test used the same scan and now shares the helper, so the footgun is gone from both. Covered by a test that pushes exactly that ref name.

Full suite green under -race, golangci-lint clean.

🤖 Generated with Claude Code