feat: transactional publish, composable hooks and simple safe defaults

[megamen32]

Philosophy

This keeps the product deliberately simple: scan scans, publish publishes, and safe behavior is automatic. No new workflow maze and no requirement to understand Git internals before the tool is useful.

The README now states the core philosophy explicitly:

• easy to start
• safe by default
• one obvious command per action
• useful without expert configuration
• flexible enough for advanced private → public setups

Included changes

• explicit --force-with-lease tied to the target SHA observed before sanitizing
• refusal to overwrite concurrent target updates
• remote SHA verification after push
• independent re-clone and scan for targets under 100 MiB
• no forced tag overwrites
• composable pre-push dispatcher that preserves existing hooks
• JSON output for CI
• restore instructions based on the actual source gitdir

Validation

• 55 tests pass
• warnings treated as errors
• python -m py_compile passes
• git diff --check passes
• end-to-end local private → public publish verified