Expand description
mkit push — push refs/packs to a remote with CAS safety.
Default (no --all): push the current branch to its upstream only,
with non-fast-forward rejection via CAS (the remote-tracking ref is
the lease). --all mirrors every refs/heads/* (now CAS-safe).
--force / --force-with-lease control the CAS policy; --dry-run
resolves the plan without contacting the remote.
Every endpoint flows through remote_dispatch::open_trusted, so the
#97 per-endpoint credential gate applies to named remotes too —
trust is keyed on the resolved ENDPOINT, never the remote name.