fix(git): reviewer reads must prefer origin over a diverged local ref (#690)

* fix(git): reviewer reads must prefer origin over a diverged local ref

_resolve_head_ref (GitService.diff/list_changed_files/read_file_at_branch)
kept local priority on ANY divergence from origin, real or rewritten. A
reviewer's clone parked on pre-rebase history after the branch's routine
force-push sync stayed frozen there across every subsequent review round,
while origin held every fix commit — QA repeatedly bounced work that had
already landed. Every caller here is a reader, never the branch's own
author mid-write, so origin now wins whenever it carries anything the
local ref lacks; local keeps priority only when it strictly contains
origin (unpushed commits, or equal).

The read-only git MCP surface (roboco_git_log) hit the same staleness
through a separate path: /api/git/log resolved the requested branch as a
bare name straight off whatever the caller's own clone had on disk, with
no fetch at all. It now routes through the same fixed _resolve_head_ref.

* test(e2e): give the armed flow-verb timeout real headroom

The armed value is also verb-2's entire execution budget (claim + every
claim guard + set_plan + start + tracing gate), which grows as guards
land; 1s flaked on loaded CI runners while passing locally. The
cancel-and-release semantics only need the timeout far below the hang.

---------

Co-authored-by: Renn F <rennf93@users.noreply.github.com>

tests/unit/services/test_git.py

@@ -722,6 +722,10 @@ async def test_diff_returns_diff_stdout() -> None:
         del check, token
         if args[:1] == ["fetch"]:
             return MagicMock(stdout="", returncode=0)
+        if args[:1] == ["rev-parse"]:
+            return MagicMock(stdout="", returncode=0)
+        if args[:1] == ["rev-list"]:
+            return MagicMock(stdout="0", returncode=0)
         return MagicMock(stdout="diff --git a b\n+hello\n", returncode=0)
 
     _bind(svc, "_run_git", AsyncMock(side_effect=_run_git))