Replace GitRepository .git-internals parsing with LibGit2Sharp

**Tier 1 — Replace.** `src/Fallout.Build/VCS/GitRepository.cs` (~268 LOC) hand-parses git internals — `.git/config`, `.git/HEAD`, `packed-refs` — and uses a regex to crack remote URLs (HTTPS/SSH). This is the single most fragile spot found in the audit: it breaks if git changes its on-disk format.

### Replace with
[**LibGit2Sharp**](https://www.nuget.org/packages/LibGit2Sharp) — the standard .NET libgit2 binding. Eliminates manual `packed-refs`/config parsing and the URL regex (use `Uri`).

### Scope
- `src/Fallout.Build/VCS/GitRepository.cs` — `FromLocalDirectory()`, `GetRemoteConnectionFromUrl()`, `GetRemoteConnectionFromConfig()`
- Keep `GitRepositoryExtensions.cs` (simple branch-name comparisons) as-is.

### Non-breaking
Wrap LibGit2Sharp behind the existing `GitRepository` public surface — additive, no consumer signature changes. Target the 2026 line directly.

### Acceptance
- [ ] `.git` file/regex parsing removed; introspection backed by LibGit2Sharp
- [ ] Public `GitRepository` API unchanged (verified against call sites)
- [ ] Existing VCS tests green; add cases for SSH/HTTPS/UNC remotes

_From dependency-consolidation audit, 2026-06-02._