Fix pull mirroring and reject additive Git overlays

[hbrodin]

coop pull could copy a newer packed-refs while retaining an older host loose ref, leaving the host on the wrong commit despite a successful transfer. Guest-deleted files also remained on the host.

This adds opt-in coop pull --delete, using rsync --delete-after so incoming ignore rules apply before deletion. Mirror mode requires working rsync on both ends and refuses to fall back to tar. Plain additive pulls refuse to overlay existing root Git metadata, including with --force; users choose mirroring or --exclude-git. Gitfiles and symlinked root .git entries require exclusion. A failed local Git status check now blocks an unforced pull.

Mirroring can remove host-only files and refs, including committed work in a clean repository. --force only bypasses the dirty check. The docs describe these semantics and rsync's behavior when ignore files are removed.

Closes #427.

Validation:

• Workspace build, format, Clippy with warnings denied, workspace tests, TOML formatting, shell syntax, and pre-commit checks pass.
• Real local Git/rsync regression tests cover packed refs, deleted files/branches, changed and nested ignore rules, exclusions, and Git metadata guards. Deliberately removing deletion or replacing --delete-after with --delete causes the corresponding regression test to fail.
• Full-file cargo-mutants sweep of src/workspace.rs and src/lib.rs: 94 mutations across an interrupted/resumed run: 73 caught, 21 did not compile, zero survivors or timeouts. .cargo/mutants.toml is unchanged.
• All eight review lenses completed; findings in docs and an integration assertion were fixed and the full diff re-reviewed.

Draft / outstanding gates:

• Added VM workspace tests for both copy-mode backends, but they have not run: the local --full runner passed bridge isolation and pre-VM phases, then failed at setup because /dev/kvm is unavailable. No macOS/Lima host is available here.
• cargo deny --workspace check fails on RUSTSEC-2026-0285 in unchanged rustls 0.23.43; dependency manifests, lockfile, and deny policy are unchanged. Address the dependency advisory separately before merge.