Read only the exact claim ref in single-key claim operations

[Deicyde]

Fixes the single-key claim operations reading the wrong ref when another ref's name ends in the same path. 2 files, +22/-3, one commit.

git ls-remote <repo> refs/autoform-claims/k lists every ref whose name ends in the path refs/autoform-claims/k. That includes refs/heads/refs/autoform-claims/k, and the claim ref of a key such as a/refs/autoform-claims/k, since claim keys may contain /. _remote_oid took the first line of that output, so read, holds, acquire, renew and release could act on another ref's commit. _remote_oids, which serves the batch operations, already keeps only the exact ref (#135). _remote_oid now does the same.

What this changes, checked on main and on this branch with the same scripts:

• A peer holding a/refs/autoform-claims/k made this worker's read("k"), holds("k") and acquire("k") raise, while acquire_many(["k"]) succeeded. The error is ClaimTransportError with a fresh scratch directory and MalformedLeaseError once the peer's commit is local. After acquire_many, holds, renew and release on k raised too, so a Heartbeat on k would set lost. On this branch all of them see only refs/autoform-claims/k.
• With refs/autoform-claims/<key> gone and a branch refs/heads/refs/autoform-claims/<key> holding this worker's lease, release(key) deleted that branch, because git push expands the destination refs/autoform-claims/<key> to the branch when no exact ref exists. On this branch release finds no claim and returns True without pushing.

How likely: the CLI's own keys come from author_claim_key, whose slug has no /, so they cannot shadow each other. Reaching either case needs a foreign or oddly named ref in the board repository. Every failure above refuses, by raising or returning False, except the branch deletion, which removes a ref other than the claim.

The new test, test_single_key_operations_read_only_the_exact_claim_ref, fails on main with ClaimTransportError. Calling _remote_oids([key]) from _remote_oid would also fix the bug, but test_overlapping_batch_race replaces _remote_oids with a two-party barrier, and single-key calls through it deadlock that test.

Overlaps with open PRs:

• Deploy Pages only after autoform verify passes, and refuse a lean: name defined twice #140 and Bind statement: formalized to a recorded statement_hash #141 edit claims.py and tests/test_claims.py through their open-statements-revision base. Each merges with this branch without a textual conflict.
• Merging open-statements-revision's history after this branch leaves two byte-identical _remote_oids definitions in claims.py, and ruff does not flag them. That history already conflicts with main in 21 files. Rebasing Deploy Pages only after autoform verify passes, and refuse a lean: name defined twice #140's and Bind statement: formalized to a recorded statement_hash #141's own commits onto main avoids the duplicate, since those commits do not touch claims.py.

Validation at exact head 32d0fa4a: ruff check autoform_cli servers tests is clean. tests/test_claims.py (101), tests/test_claim_cli.py (10), tests/test_dashboard.py (14) and tests/test_impact.py (73) pass.