fix: normalize authorship notes before push

[peckfly]

Summary

Fixes #1376.

Some repositories can reject pushes to refs/notes/ai when the notes history contains legacy git-ai generated commits with placeholder identities such as git-ai@local or empty/non-conventional commit messages. This can leave authorship notes unable to sync even though the note contents themselves are valid.

This change:

• writes new refs/notes/ai fast-import commits with the repository's configured Git identity and a conventional chore: subject
• normalizes legacy local notes history before pushing authorship notes, preserving the current notes tree and the fetched remote base when available
• updates fallback notes merge commits to use the same safe metadata path
• adds coverage for safe notes commit metadata and history normalization

Verification

• cargo fmt --check
• cargo build --bin git-ai
• cargo test --test integration refs_unit:: -- --nocapture
• cargo test --test integration push_authorship_notes -- --nocapture
• cargo test --test integration 'fetch_notes::' -- --nocapture
• cargo test --test notes_sync_regression -- --nocapture
• local end-to-end simulation with a bare remote pre-receive hook rejecting legacy notes identities and non-conventional notes subjects

Note: cargo test --test integration fetch_notes -- --nocapture also selects an unrelated ci_local_skip_fetch worktree test on this machine; that one failed because the installed Git does not support git worktree add --orphan. The targeted fetch_notes:: tests passed.

---

[peckfly]

Addressed the review finding in 165c70d. When normalization uses a fetched tracking ref as the parent, it now builds the replacement notes tree from remote/base notes first and local notes second, so remote-only notes are preserved and local notes still win on conflicts. Added a regression test for the failed-merge hazard state where local refs/notes/ai lacks a remote-only note but normalization uses the remote tracking ref as parent.