Keep a local-only manifest off every branch but the integration branch

[Yehonal]

Summary

With syncwheel_tracking: local-only, every integration rebuild still wrote a manifest-only control commit onto the integration branch and staged .syncwheel/manifest.json, and several publish paths could push it anywhere — including the canonical remote's base branch, for example when the integration branch shares the base branch's name or when a second remote name points at the canonical URL. The commit also copied the parent's author and committer, so it was attributed to whoever wrote the previous commit.

• No control commit for local-only repositories without active coordination. The planner treats an integration tree without the manifest as converged; a legacy control commit is dropped on the next rebuild; the manifest file is kept byte-identical through the reset (default, -M and -p paths), and the protective step is printed in --dry-run transcripts too. Coordinated local-only repositories keep the control commit, which the protocol reads back from the published tip.
• One push rule, in one place. Every Syncwheel push goes through run_authorized_push, which now refuses to send a tree carrying a local-only control manifest anywhere except the integration branch (when it is not the canonical remote's base branch) and Syncwheel coordination refs. The canonical remote is recognized by its normalized push URL, not by remote name. stack land, stack push, reconcile, int push, publish, channel publish and coordination repair are all covered by construction.
• Fixed control-commit identity. Git-tracked control commits use Syncwheel Control <control@syncwheel.invalid> with the parent's commit time, a pinned commit encoding and a cleared GIT_CONFIG_PARAMETERS, so every clone still computes the same SHA without borrowing a person's name. Control tips and pending intents written by earlier versions are still recognized and recovered. Published control tips change SHA once: upgrade all clones together.
• Git-tracked repositories publish exactly as before; --force-with-lease is passed through unchanged.

Version 0.44.0.

Test plan

• 28+ new tests, each red on 0.43.35 for the intended reason: no control commit for local-only, legacy drop with the file preserved (external, personal, staged+modified, crash between capture and restore, no checkout on the branch), dry-run transcript executed literally, convergence in one pass, every push route refused for a local-only manifest (land, second remote name for the canonical URL, coordinated and plain stack push, reconcile stack push, coordination repair), git-tracked repos unaffected on the same routes, coordinated local-only still publishing its integration branch and state, fixed identity and encoding determinism, legacy intents and tips still recovered
• Full targeted sweep on Python 3.12: 972 tests green
• Five review rounds with adversarial verification; the last round's push-route reproductions re-run on the final code: the manifest only ever reaches the integration branch
• scripts/check-version-bump.py --base origin/main, docs/sync_version.py --check
• CI matrix