Apply a push's index delta as the push lands, and check the ref by reading it

Apply a push's index delta as the push lands, and check the ref by reading it

A push's metadata delta used to be applied by the next reader, so the
first page after a big push paid for the whole push. And search checked
every visible repository before querying: a `symbolic-ref` to open it and
a `rev-parse` to see whether the metadata branch moved, so N repositories
cost 2N git processes per search.

- Post-receive now opens the index (the SSH server hands it `VOLE_INDEX_DB`
  and the repository id) and runs Ensure after the refs have moved, which
  is also after a followed request's head has moved. A failure is reported
  and ignored: the refs have landed, and the next read still repairs it.
- `git.Repo.RefCommit` resolves a branch ref by reading the loose ref file
  git writes for every branch update, and falls back to `rev-parse` for a
  packed ref, a symbolic ref, or a missing one. The index's Ensure and the
  web's metadata-head read use it.
- `repo.Store.Meta` builds a repository handle without a HEAD lookup, and
  search uses it: the refresh needs the directory and the ACL, not the
  default branch. The per-repository check is now two file reads instead
  of two processes.

Load harness, `search-find` at concurrency 4 over three repositories:
510.2 req/s and p50 7 ms before, 814.8 req/s and p50 4 ms after. A push
that changes the `vole` branch leaves the rows current before the push
returns; a test queries them with no Ensure in between.