An upstream that merges cleanly opens one pull from upstream/<tip7>, and a branch someone planted there opens nothing #3978

For: following an upstream, layer 3 of 5 (split from #3622). Source: refs/pull/3722/head, the proposal half of src/actions/upstream_follow.ts.

Done:

• [ ] When a check finds new upstream commits that merge cleanly into the default branch, it pushes upstream/<tip7> at the fetched head and opens one pull, or updates the open one. A second check with nothing new opens nothing.
• [ ] When upstream/<tip7> already exists, resolveOid(dir, 'refs/heads/' + name) must equal the fetched head. Otherwise the check fails, notes the error on the follow row, opens no pull and leaves the planted branch untouched. A squat test proves all three.
• [ ] A conflicting merge is recorded on the row as "conflict" and opens nothing yet (the converge run is the next layer).
• [ ] bun x tsc --noEmit and bun test test/upstream_follow.test.ts pass.

Files: src/actions/upstream_follow.ts, test/upstream_follow.test.ts. Risk: a branch name collision with a person's branch. The squat rule covers it. If the check fails where it ran and not in the change, say so in the pull.