feat(lanes,git): publish a repo with no remote, and read a repo with no commits

What broke: a lane on a fresh `git init` repo had no working git surface.
`statusCounts` ran `rev-parse --short HEAD` unguarded, so `gitFacts` threw
and `GET /api/lanes/:id/git` answered `{available:false}` — the Changes
panel showed no header, and `commit`/`switch` 500'd through `isDirty`.
Add lane in Worktree mode accepted such a repo and left a `failed` row
behind, and a repo with commits but no remote had a permanently disabled
Push with no way to give it one short of a terminal.

What changed:
- worktree.js: an unborn HEAD is a normal state. `statusCounts` reports
  `head: null`; `gitFacts` reads the branch via `symbolic-ref`, an empty
  subject, and a new `unborn` field.
- git-ops.js: an 11th write, `publish` — `remote add origin -- <url>` then
  `push -u origin HEAD`, only with a commit (ENOCOMMITS) and NO remote at
  all (EREMOTEEXISTS, so it never re-points one), the url allowlisted by
  `validateRemoteUrl` (https without userinfo, ssh://, scp-like; refuses
  local paths, file://, ext::, fd::, git://, http://, leading `-`:
  EBADURL), and `origin` removed again when the push fails.
- POST /api/lanes/worktree answers 400 EEMPTYREPO for a repo with no
  commits instead of creating a row that can only fail.
- LaneGitBar: unborn repos show "no commits yet" and a commit-first hint;
  no remote offers Publish… with an inline URL box; a remote but no
  upstream relabels Push as "Publish branch". AddLaneModal disables Add
  on an empty repo and offers "Use as a Repo lane".
- The two tests that used an unborn repo to force a provisioning failure
  now use a `feat` ref clash, since that repo is refused up front.
- CLAUDE.md rule reworded to "the boring eleven" with publish's guards;
  docs/API.md, docs/LANES.md, ARCHITECTURE.md, server/README.md, openapi.

client/src/components/lanes/__tests__/AddLaneModal.test.tsx

@@ -305,6 +305,28 @@ describe("AddLaneModal — worktree mode (default)", () => {
     expect(screen.getByRole("button", { name: "Add lane" })).toBeDisabled();
   });
 
+  it("refuses a worktree of a repo with no commits and steers to Repo mode", async () => {
+    vi.mocked(api.lanes.branches).mockResolvedValue({
+      branches: [],
+      current: "main",
+      worktrees: [],
+    });
+    renderModal();
+    const user = userEvent.setup();
+
+    const repoField = screen.getByLabelText("Source repository");
+    await focusField(user, repoField);
+    await user.type(repoField, "/Users/tester/projects/empty");
+    expect(await screen.findByText(/commit first, then publish/i)).toBeInTheDocument();
+    await user.type(screen.getByLabelText("Title"), "demo");
+    // There is nothing to branch from, so the worktree cannot be created.
+    expect(screen.getByRole("button", { name: "Add lane" })).toBeDisabled();
+
+    await user.click(screen.getByRole("button", { name: "Use as a Repo lane" }));
+    expect(screen.getByRole("button", { name: "Repo" })).toHaveAttribute("aria-pressed", "true");
+    expect(screen.getByRole("button", { name: "Add lane" })).toBeEnabled();
+  });
+
   it("submits through the worktree provisioning endpoint, with the typed branch name", async () => {
     vi.mocked(api.lanes.branches).mockResolvedValue({
       branches: ["main"],

client/src/components/lanes/__tests__/LaneGitBar.test.tsx

@@ -1,7 +1,8 @@
 /**
  * @file LaneGitBar.test.tsx
  * @description Pins the lane git action row: the ahead/behind readout, which
- * buttons a repo with no remote may press, that it offers no commit (the
+ * buttons a repo with no remote may press (and that it may publish to a typed URL),
+ * what an unborn repo and a branch with no upstream show, that it offers no commit (the
  * Changes panel's staged-only box owns that), that a dirty tree blocks the branch switch client-side (the server
  * refuses it too), and that a failed action shows git's own words rather than
  * a generic sentence.
@@ -24,6 +25,7 @@ function facts(over: Partial<Extract<LaneGitFacts, { available: true }>> = {}):
     available: true,
     branch: "feat/thing",
     head: "9b3e74a",
+    unborn: false,
     subject: "wip",
     dirty: 2,
     untracked: 1,
@@ -79,6 +81,65 @@ describe("LaneGitBar", () => {
     expect(screen.queryByRole("button", { name: /Commit/ })).toBeNull();
   });
 
+  it("shows an unborn repo's branch and asks for a first commit instead of a push", () => {
+    render(
+      <LaneGitBar
+        laneId={3}
+        git={facts({
+          branch: "main",
+          head: null,
+          unborn: true,
+          subject: "",
+          hasRemote: false,
+          upstream: null,
+          ahead: null,
+          behind: null,
+        })}
+        onChanged={vi.fn()}
+      />
+    );
+    expect(screen.getByTestId("lane-git-bar")).toHaveTextContent("no commits yet");
+    expect(screen.getByText(/Commit first, then publish/)).toBeInTheDocument();
+    expect(screen.queryByRole("button", { name: /Fetch|Pull|Push|Publish/ })).toBeNull();
+  });
+
+  it("publishes a repo with no remote to a typed URL", async () => {
+    const user = userEvent.setup();
+    const onChanged = vi.fn();
+    render(
+      <LaneGitBar
+        laneId={3}
+        git={facts({ hasRemote: false, upstream: null, ahead: null, behind: null })}
+        onChanged={onChanged}
+      />
+    );
+
+    await user.click(screen.getByRole("button", { name: "Publish…" }));
+    await user.type(screen.getByLabelText(/Remote URL/), "git@host:owner/repo.git");
+    await user.click(screen.getByRole("button", { name: "Publish" }));
+
+    await waitFor(() =>
+      expect(api.lanes.gitAction).toHaveBeenCalledWith(3, "publish", {
+        url: "git@host:owner/repo.git",
+      })
+    );
+    expect(onChanged).toHaveBeenCalled();
+  });
+
+  it("calls a first push of a branch with no upstream 'Publish branch'", async () => {
+    const user = userEvent.setup();
+    render(
+      <LaneGitBar
+        laneId={3}
+        git={facts({ upstream: null, ahead: null, behind: null })}
+        onChanged={vi.fn()}
+      />
+    );
+    expect(screen.queryByRole("button", { name: /^Push$/ })).toBeNull();
+    await user.click(screen.getByRole("button", { name: "Publish branch" }));
+    await waitFor(() => expect(api.lanes.gitAction).toHaveBeenCalledWith(3, "push", {}));
+  });
+
   it("loads the branch list on demand and refuses to switch while dirty", async () => {
     const user = userEvent.setup();
     render(<LaneGitBar laneId={3} git={facts()} onChanged={vi.fn()} />);