Rollback release steps on any failure

If -R failed at git push or any later step, the local commit and tag
were left behind, requiring manual cleanup. Now a rollback stack is
populated as each side-effecting action succeeds and drained in reverse
on failure to restore working tree, local refs, and remote refs.

Notable choices: write-tree snapshots the pre-commit index so a --soft
reset plus read-tree restores the user's staged hunks byte-for-byte.
update-ref preserves annotated tags (tag -f would downgrade them to
lightweight). Remote rollback uses --force-with-lease to guard against
concurrent pushes and is skipped entirely with a warning when the
pre-push ls-remote probe fails — guessing prior state could destroy
refs we don't own.

Fixes #46

Co-Authored-By: Claude (Opus 4.6) <noreply@anthropic.com>

Author: silverwind