fix(cli): make lfsx gc fetch every ref and refuse clones that cannot see them

[BryanFRD]

Closes #599

lfsx gc built its keep list from whatever the local clone happened to hold. Now it:

• fetches all branches and tags (pruned) from origin first
• fetches refs/pull/* and refs/merge-requests/* into refs/lfsx/ by default, --no-review-refs opts out
• refuses a clone whose remote.origin.fetch is not a wildcard over refs/heads/*
• reads --url and --repo from git config lfs.url when not given (--url/LFSX_URL is now optional for gc only), and refuses a mismatch with the clone
• keeps the shallow-clone refusal

Behaviour change on a destructive command: runs that used to proceed now refuse (single-branch clone, --url/--repo not matching lfs.url), and gc now runs git fetch against origin. Not breaking for valid setups, so no !.

docs/reclaiming-space.md gets the scheduled CI recipe (admin PAT passed as LFSX_TOKEN).

[ferrfleet-interne]

The fetch, prune, shallow and single-branch handling and its tests look right. One blocking issue: inferring and checking lfs.url ignores .lfsconfig, which is how the docs tell users to configure it (see inline).

[ferrfleet-interne]

The .lfsconfig blocker is fixed in 18d2029. Nothing else blocking.

[ferrfleet-interne]

Rebased onto main. The PR's code is unchanged since my approval of 18d2029, and the Server::new call now matches #648. One stale doc line, see inline.

[ferrfleet-interne]

8958f5a applies the LFSX_TOKEN doc nit. It only touches docs, and nothing is outstanding.