feat(lanes,git): publish a repo with no remote, and read a repo with no commits

What broke: a lane on a fresh `git init` repo had no working git surface.
`statusCounts` ran `rev-parse --short HEAD` unguarded, so `gitFacts` threw
and `GET /api/lanes/:id/git` answered `{available:false}` — the Changes
panel showed no header, and `commit`/`switch` 500'd through `isDirty`.
Add lane in Worktree mode accepted such a repo and left a `failed` row
behind, and a repo with commits but no remote had a permanently disabled
Push with no way to give it one short of a terminal.

What changed:
- worktree.js: an unborn HEAD is a normal state. `statusCounts` reports
  `head: null`; `gitFacts` reads the branch via `symbolic-ref`, an empty
  subject, and a new `unborn` field.
- git-ops.js: an 11th write, `publish` — `remote add origin -- <url>` then
  `push -u origin HEAD`, only with a commit (ENOCOMMITS) and NO remote at
  all (EREMOTEEXISTS, so it never re-points one), the url allowlisted by
  `validateRemoteUrl` (https without userinfo, ssh://, scp-like; refuses
  local paths, file://, ext::, fd::, git://, http://, leading `-`:
  EBADURL), and `origin` removed again when the push fails.
- POST /api/lanes/worktree answers 400 EEMPTYREPO for a repo with no
  commits instead of creating a row that can only fail.
- LaneGitBar: unborn repos show "no commits yet" and a commit-first hint;
  no remote offers Publish… with an inline URL box; a remote but no
  upstream relabels Push as "Publish branch". AddLaneModal disables Add
  on an empty repo and offers "Use as a Repo lane".
- The two tests that used an unborn repo to force a provisioning failure
  now use a `feat` ref clash, since that repo is refused up front.
- CLAUDE.md rule reworded to "the boring eleven" with publish's guards;
  docs/API.md, docs/LANES.md, ARCHITECTURE.md, server/README.md, openapi.

client/src/components/lanes/AddLaneModal.tsx

@@ -379,7 +379,7 @@ export function AddLaneModal({
     !done &&
     (!sourceRepo.trim() ||
       (mode === "worktree" &&
-        (!title.trim() || !branches || (branchMode === "existing" && !branch.trim()))));
+        (!title.trim() || !branches?.length || (branchMode === "existing" && !branch.trim()))));
 
   /** branch name -> the worktree directory already holding it. git allows one
    *  checkout per branch, so these are the branches this form cannot use. */
@@ -553,7 +553,18 @@ export function AddLaneModal({
                     {t("addLaneBaseLabel")}
                   </label>
                   {branches.length === 0 ? (
-                    <p className="text-[10px] text-fg-muted">{t("addLaneNoBranches")}</p>
+                    // No commit, nothing to fork: the server refuses this with
+                    // EEMPTYREPO, so the one way forward is offered instead.
+                    <div className="space-y-1">
+                      <p className="text-[10px] text-fg-muted">{t("addLaneNoBranches")}</p>
+                      <button
+                        type="button"
+                        onClick={() => setMode("repo")}
+                        className="rounded-md border border-border-light px-2 py-0.5 text-xs text-fg-secondary hover:bg-surface-2"
+                      >
+                        {t("addLaneNoBranchesUseRepo")}
+                      </button>
+                    </div>
                   ) : (
                     <select
                       id="add-lane-base"