fix: resolve abbreviated relocation branch SHAs

[andrei-hasna]

Summary

Fixes the live Infinity relocation blocker where branches.last_commit_sha stores abbreviated commit IDs while divergent-branch preservation requires exact target ref evidence.

Changes:

• resolve stored branch commit values through the trusted target Git object store;
• accept only unambiguous commit objects;
• keep missing, ambiguous, non-commit, name-collision, and ref-mismatch cases fail-closed;
• bind resolved evidence into preservation/target evidence hashes and the reviewed plan hash;
• normalize preserved and moved branch rows to full commit IDs during apply.

Verification

Exact head under review: 161593f6cc23c40c0fcfddaf9cbfd344739888c2
Base: 25c1240d80c186b9c9ef55e26589fb5334f0e968

Passed:

• git diff --check origin/main...HEAD
• bun test src/db/primary-relocation.test.ts — 57 pass, 0 fail
• bun run typecheck
• gitleaks git --log-opts=25c1240..HEAD --redact --no-banner .
• gitleaks protect --staged --redact --verbose
• bun run build

Full-suite caveat:

• bun test currently has 7 failures in src/lib/no-cloud-inventory.test.ts.
• The same failures reproduce on exact base 25c1240, and this PR does not modify src/lib/no-cloud-inventory.test.ts, src/lib/no-cloud-inventory.ts, package.json, or bun.lock.

Review:

• Two independent read-only reviewers found no P0/P1 issues and marked this PR-ready.
• Accepted non-blocking P2s: add explicit SHA-256/target-side/CLI regression coverage later; live relocation apply still requires fresh dry-run receipts, explicit resolved-commit evidence, and target quiescence verification.

Scope

No relocation apply, publish, deploy, or runtime install is performed by this PR.