Add safe Windows pull preflight workflow

[yangboxuan726]

Summary

• Route every Windows Source Control Pull entry through one Fetch → preflight → policy → Pull → refresh workflow.
• Block missing upstreams, up-to-date branches, and dirty working trees with actionable messages.
• Use ffOnly when only the upstream is ahead; require an explicit Merge, Rebase, or safe-default Cancel choice when histories diverge.
• Reuse the existing merge/rebase operation banner when Pull stops for conflict resolution.
• Keep the command-palette compatibility entry on the same safety path, defaulting divergent headless requests to Cancel.

User impact

Pull no longer relies on stale remote refs or implicit Git reconciliation settings. All visible Source Control entry points share busy/deduplication state, error text, strategy selection, and a complete working-tree/history/refs/remotes refresh.

Validation

• Isolated Bun tests: 20 passed, 0 failed
• bun run typecheck
• .\scripts\verify-windows-boundaries.ps1
• .\scripts\build-windows.ps1 -Configuration Release
• cargo test --manifest-path windows/tauri/src-tauri/Cargo.toml (36 passed)
• git diff --check
• Dirty-guard mutation check: expected red, then green after restoration
• Real bare remote + two-clone acceptance: ffOnly, divergent Cancel, Rebase, Merge, and dirty block
• Actual Windows Tauri run against a real divergent temporary repository

UI

Actual Windows Tauri runtime against a real divergent temporary repository. Source Control shows a clean working tree, local ahead 2 / remote ahead 1, and the explicit Cancel / Rebase / Merge choice.