fix: bind branch safety to origin write target

[Raithlin]

Summary

• Bind branch provider safety checks to the checkout's origin write target.

Changes

• Reject mismatched --repo or configured repositories before origin writes, including forced rename and delete.
• Account for a configured origin push URL and reject multiple push URLs for provider checks.
• Keep provider neutral branch creation available and add mismatch coverage, command help, and documentation.

Validation

• make check — lint and tests passed; coverage 95.1% (required 95%).

Checklist

• Tests cover the changed behavior.
• Documentation and command help are updated.
• Structured output contracts remain backward compatible.
• Origin write safety applies to dry runs and execution.