Keep the index current at push time and check it without a process

Why

Closes #124. Two costs remained after #113: a push’s metadata delta was applied by the next reader (so the first page after a big push paid for the push), and search checked every visible repository with two git processes — symbolic-ref to open it and rev-parse to see whether the metadata branch moved — so N repositories cost 2N processes per search.

What changed

• Post-receive applies the delta when the push lands. The SSH server hands the hook VOLE_INDEX_DB and the repository id; the hook opens the index and runs Ensure after the refs have moved, which is also after a followed request’s head has moved. A failure is reported on the pusher’s terminal and ignored: the refs have landed, and the next read still repairs the rows.
• git.Repo.RefCommit reads a loose ref file — what git writes for every branch update — and falls back to rev-parse for a packed ref, a symbolic ref, or a missing ref. The index’s Ensure and the web’s metadata-head read use it. A test packs the refs and checks that the fallback still answers.
• repo.Store.Meta builds a repository handle without a HEAD lookup, and search uses it: the refresh needs the directory and the ACL, not the default branch. The check is now two file reads instead of two processes per visible repository.

Measurement

Load harness search-find (three visible repositories), concurrency 4, 5 s:

A push that changes the vole branch leaves the rows current before the push command returns: TestPushRefreshesTheIndexBeforeTheNextRead queries them with no Ensure in between.

Checks

gofmt, go vet ./..., python3 scripts/check-links.py, ./vole workflow check, and the full -race suite with GOFLAGS=-tags=sqlite_fts5. Docs: docs/architecture.md now says how the index is kept current.

Notes

This does not remove the ref update itself or the diff/merge work a change page does; those are the work, not a check. A page whose index is stale because a hook did not run applies the delta on read, exactly as before — the loose-ref read is only how the check is made cheap.