EPMDEDP-17252: fix: Make create-strategy provisioning idempotent and refuse destructive pushes

[SergK]

Business impact: protects the two moments users trust the platform most — first provisioning of a new codebase and its recovery after a transient failure. Testbed reproduction showed the defect is silent data loss, worse than the permanent wedge originally filed: a reconcile re-entering project provisioning regenerates squashed history and the push replaces the remote default branch, because go-git cannot verify fast-forward when the remote's current commit is absent from the fresh unrelated history, and admin credentials bypass server-side branch protection. Any commits made to the repository before such a retry were destroyed without a trace or an error.

The durable record of a push is the remote branch itself, not operator state. Provisioning now:

• probes the remote default branch (packless reference resolution; an empty or missing repository counts as absent) before pushing, and records a push-in-progress checkpoint in the git status only when the branch was verified absent - so the checkpoint plus a present branch can later mean only one thing: our own push landed
• on re-entry with that checkpoint, adopts the landed push instead of regenerating history: skips provisioning entirely and re-runs only the idempotent default-branch setup, converging where it previously wedged or destroyed history
• refuses to push when the remote default branch exists without the checkpoint, failing with an explicit message instead of overwriting content this provisioning provably did not create
• clears a stale .git before init in empty-project provisioning, matching the squash path, so a surviving workdir cannot fail retries

Probe transport failures propagate rather than guessing absent: guessing would regenerate history against a remote that may hold the previous push. The checkpoint survives all status rewrites, which preserve the git field.

[epmd-edp]

Pipeline review-codebase-operator-master-l9wgx ✅ Passed

Status	Task	Duration
✅	github-set-pending-status	8s
✅	fetch-repository	15s
✅	init-values	5s
✅	get-cache	2m3s
✅	commit-validate	7s
✅	dockerfile-lint	9s
✅	helm-lint	6s
✅	helm-docs	24s
✅	build	51s
✅	sonar	30s
✅	save-cache	8s
✅	buildkit-build	31s
✅	github-report-pipeline-status	5s