Harden sync rebase boundary derivation

[brdv]

Motivation

• Improve reliability of stck sync rebase boundaries so rewritten ancestry (including squash-merge flows) yields correct git rebase --onto boundaries.
• Preserve the existing --onto execution model while making boundary selection more robust against missing local refs and rewritten history.
• Cover regressions observed in sync/push flows with deterministic, testable fallbacks.

Description

• Add gitops::derive_rebase_boundary which attempts git merge-base --fork-point (old-base candidates), then git merge-base (old-base candidates), then git merge-base (new-base candidates), and finally falls back to existing old-base ref resolution.
• Replace the old resolve_old_base_for_rebase call in sync execution with derive_rebase_boundary so each rebase step uses the derived boundary SHA.
• Extend the CLI test stubs in tests/cli_skeleton.rs to simulate merge-base --fork-point and merge-base behaviors and add regression tests for fork-point fallback, merge-base fallback, and missing-local-old-base fallback.
• Changes are limited to src/gitops.rs, src/cli.rs, and tests/cli_skeleton.rs to keep the diff focused on Milestone A scope.

Testing

• Ran formatting and linting with cargo fmt --all and cargo clippy --all-targets --all-features -- -D warnings, and both completed successfully.
• Executed the full test suite with cargo test --all-features, which ran unit tests (20 tests) and CLI/integration tests (44 tests) for a total of 64 tests and all tests passed.
• New/updated tests exercised fork-point and merge-base fallbacks and the missing-local-old-base fallback and all assertions succeeded.

---

Codex Task