submit: Refuse to overwrite commits pushed to a branch by someone else

[ed-irl]

gs branch submit previously force-pushed with a lease against the remote-tracking ref, which advances on every fetch and so could silently overwrite commits a maintainer (or anyone else) added to a branch after git-spice last pushed it.

Submit now leases against the commit git-spice itself last recorded pushing. Because that baseline only changes when git-spice pushes, it survives local restacks while still catching foreign commits. Before pushing, submit classifies the remote:

• Advanced — the remote gained commits on top of our last push. Submit refuses, lists the offending commits (now including author email), and points to gs branch sync.
• Diverged — the remote was rewritten away from our last push. Submit refuses since it can't tell what a force-push would discard.
• No baseline — no record of the last push and the remote differs. Submit refuses rather than guess.
• Safe / fast-forward / up-to-date — push proceeds, leasing against the recorded baseline.

--force overrides all of these.

Supporting changes:

• git.ListCommitsDetails now also reports each commit's author email (%ae), used when listing foreign commits.
• gs branch sync --rebase records the integrated remote head as the new baseline. A conflict-interrupted sync resumes via a hidden --record-pushed continuation that records the baseline without re-running the rebase.
• branch split carries the last-pushed baseline onto the new branch so a later submit still has a baseline to check against.

Documented in the CR guide; added test scripts covering the advanced, diverged, and force-push cases.

[ed-irl]

This change is part of the following stack:

• restack: Add Options parameter to high-level restack entry points #1307
  • sync: Add failing test scripts for branch sync feature #1262
    • submit: Refuse to overwrite commits pushed to a branch by someone else #1308 ◀

_{Change managed by git-spice.}