multi: add gix-ref-store crate (RefStore read/CAS split, loose-ref impl)

Phase 1 per docs/development-plan.adoc. Implements arch.refstore-read-cas-split (RefStoreRead vs RefStore, so the gate can depend on reads only) and arch.loose-cas-discipline (LooseRefStore writes through gitoxide’s own in-process ref transaction, never a git update-ref subprocess) from overview.sdoc.

The CAS conformance suite (tests/conformance.rs) that stands in for the Phase 1 → 2 gate exposed a real gap in the pinned gitoxide version: the file-transaction precondition check reads a ref’s current value before acquiring that ref’s own lock file, so two independent gix::Repository handles racing the same ref (two processes, concretely) can both observe the same stale precondition and both "win" a create or update. Closing that is exactly what "its own compare-and-swap discipline" asks for, so LooseRefStore::transaction now holds a store-level lock (a .lock file distinct from any ref’s own, acquired via gix-lock) around the whole read-check-write sequence before ever calling into gitoxide, rather than trusting gitoxide’s internal ordering alone. Costs cross-ref concurrency (one lock serializes all refs in a repository) in exchange for actual correctness; a per-ref-set lock is a straightforward follow-up if the cost matters in practice.

facet-git-tree needed no phase-1 work: it already lives as an external crate (git dependency on github.com/git-ents/facet-git-tree), the #[facet(transparent)] fix already landed upstream (a910057), and the workspace Cargo.toml already has no local [patch] section to remove — verified rather than redone.

crates (refstore-postgres, effect-dispatcher, git-ents-server, git-effect) that don’t exist yet in this workspace; a filter naming an absent package is a hard nextest config error, so it’s trimmed back to just the group definition until those crates land in their own phases.

Assisted-by: Claude:claude-sonnet-5