feat(git): Branches & tags panel — rename, branch from any ref, upstream, tags

GET /git/refs lists local branches (upstream, ahead/behind, last commit,
merged, held by a worktree, protected), remote branches grouped by remote
and tags (target, annotated message/tagger/date). New writes in
server/lib/git-refs.js, dispatched from git-ops.js: branch-rename,
branch-upstream (set/unset), tag-create (light/annotated), tag-delete
(confirm), tag-push (one tag to origin, no --tags, no force), and
branch-create with a looked-up from + switch on a clean tree. Every ref is
looked up, never passed through; repo-wide writes are repo-root only
(ESUBDIR) and refused during any operation (EMERGING).

Client: git/BranchManager + TagManager dialog opened from the git bar's
tags icon, en+vi (gitRefs namespace), keyboard navigable.

# Conflicts:
#	CLAUDE.md
#	client/src/components/lanes/LaneGitBar.tsx
#	docs/API.md
#	server/__tests__/lanes-api.test.js
#	server/routes/lanes.js

server/openapi-extra.js

@@ -25,6 +25,8 @@ const artifacts = require("./openapi-extra/artifacts");
 const lanesMore = require("./openapi-extra/lanes-more");
 const toolsMore = require("./openapi-extra/tools-more");
 const opsMore = require("./openapi-extra/ops-more");
+// The git bar's Branches panel (GET /git/refs + the branch & tag writes).
+const gitRefs = require("./openapi-extra/git-refs");
 // Enriched overrides of already-documented endpoints — same operationId, tags,
 // and request/response `$ref` schemas as the base, with added examples and
 // richer descriptions. Listed last so they win the merge.
@@ -69,5 +71,8 @@ module.exports = combine(
   overrideSessionsAgents,
   overrideCore,
   overridePricingAlerts,
-  overrideOps
+  overrideOps,
+  gitRefs
 );
+// The branch & tag writes join the git action entry in place.
+gitRefs.extend(module.exports);