Concurrent branch edits can reject the final push

## Context

From [#56 discussion](https://github.com/konveyor/agentic-controller/issues/56#issuecomment-5134307097).

The harness's final push is a non-force push. If a human (or another process) pushes to the target branch while a stage is running, the harness's final push is rejected with a non-fast-forward error, and the stage fails even though the agent's work completed successfully.

## Impact

Low priority — this requires someone to push to the migration branch during an active stage, which is unlikely in normal workflows. But it can happen, especially during interactive approval flows where a user might edit files on the branch directly.

## Possible approaches

- **Rebase-and-retry**: pull remote changes, rebase the harness's commits, retry push (risk: merge conflicts)
- **Detect and warn**: if push fails with non-fast-forward, log a clear message explaining the conflict instead of a generic push error
- **Lock the branch**: use a branch protection rule or advisory lock during stage execution

## References

- Parent: #56
- Related: #54

Start at the harness's final push entry point and trace how non-fast-forward errors are handled. Choose the approved conflict behavior, then add coverage for a concurrent branch update and verify the stage reports the intended result.

Written by the indexing model from the issue text.