feat: 新增 git retime，把指定日期范围的提交时间改到 21:00-23:00 并强推

- 保留每个提交的原日期，只重排时分秒到 21:00-23:00；同日严格递增，
  间隔 5-40 分钟且秒位随机；窗口不足时自动压紧并在预览中标注
- 支持 --window/--since/--until、--interval（含 match-remote）、--seed、
  --remote、--branch、--no-push
- 安全措施：默认只预览（退出码 2）、脏工作区拒绝、改写前创建
  refs/kopsc-backup/<分支>-<时间戳> 备份、推送前比对 tree 哈希、
  只用 --force-with-lease
- BuiltinRequest 增加 Confirmed，使内置命令能获知 CLI 已确认 --yes
- 文档：新增 README.git.md，主 README 补充导航与示例

internal/executor/gitpush_test.go

@@ -0,0 +1,72 @@
+package executor
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+)
+
+func TestForcePushUsesLease(t *testing.T) {
+	runner := &fakeGitRunner{responses: map[string]gitResponse{
+		"push --force-with-lease origin main": {out: "ok"},
+	}}
+	if err := forcePush(context.Background(), runner, "origin", "main"); err != nil {
+		t.Fatalf("forcePush: %v", err)
+	}
+	// Never a bare --force: the lease protects concurrent pushes.
+	if len(runner.calls) != 1 || runner.calls[0] != "push --force-with-lease origin main" {
+		t.Fatalf("calls = %v", runner.calls)
+	}
+	for _, call := range runner.calls {
+		if strings.Contains(call, "--force ") || strings.HasSuffix(call, " --force") {
+			t.Fatalf("unexpected bare --force: %q", call)
+		}
+	}
+}
+
+func TestForcePushExplainsRejectedLease(t *testing.T) {
+	runner := &fakeGitRunner{responses: map[string]gitResponse{
+		"push --force-with-lease origin main": {
+			errOut: " ! [rejected]        main -> main (stale info)",
+			err:    errors.New("exit status 1"),
+		},
+	}}
+	err := forcePush(context.Background(), runner, "origin", "main")
+	if err == nil {
+		t.Fatal("expected an error")
+	}
+	for _, want := range []string{"强推被拒绝", "git fetch", "回滚"} {
+		if !strings.Contains(err.Error(), want) {
+			t.Errorf("error missing %q: %v", want, err)
+		}
+	}
+}
+
+func TestIsRejectedPush(t *testing.T) {
+	yes := []string{
+		"! [rejected] main -> main (stale info)",
+		"remote: pre-receive hook declined",
+		"protected branch hook declined",
+	}
+	for _, s := range yes {
+		if !isRejectedPush(s) {
+			t.Errorf("isRejectedPush(%q) = false, want true", s)
+		}
+	}
+	if isRejectedPush("fatal: unable to access remote") {
+		t.Error("network errors are not lease rejections")
+	}
+}
+
+func TestForcePushReportsNetworkError(t *testing.T) {
+	runner := &fakeGitRunner{responses: map[string]gitResponse{
+		"push --force-with-lease origin main": {
+			errOut: "fatal: unable to access remote", err: errors.New("exit 128"),
+		},
+	}}
+	err := forcePush(context.Background(), runner, "origin", "main")
+	if err == nil || !strings.Contains(err.Error(), "git push 失败") {
+		t.Fatalf("err = %v, want a git push failure", err)
+	}
+}