mr sync: Verify commits are pushed before updating lock files

Context

We encountered an issue where mr sync (or the megarepo nix generator) updated lock files to reference local commits that hadn't been pushed to the remote yet. This caused devenv to fail with a misleading error when it later tried to fetch those commits from GitHub.

Related: https://github.com/cachix/devenv/issues/2439

The Problem

When updating devenv.lock or flake.lock files that reference peer repos (e.g., effect-utils), the current behavior locks to the local HEAD of that repo. If those commits haven't been pushed, the lock file becomes invalid for anyone else (or even the same machine after clearing caches).

Proposal

Before updating a lock file to reference a peer repo's commit, mr sync should verify that the commit exists on the remote:

# Check if commit exists on remote
git fetch origin
git branch -r --contains <commit>
# or
git merge-base --is-ancestor <commit> origin/main

If the commit isn't pushed, mr sync could either:

1. Error out with a clear message: "Cannot update lock: commit abc123 in effect-utils is not pushed to origin"
2. Warn but continue (for cases where you intentionally want local-only refs)
3. Auto-push the commits first (probably too aggressive)

Open Questions

• Should this be opt-in or opt-out behavior?
• Should it check all remotes or just origin?
• Should it check if the commit is on a specific branch (e.g., main) or just that it exists on the remote?
• How should this interact with path: inputs that are intentionally local-only?

Acceptance Criteria

• mr sync detects when a peer repo has unpushed commits
• Clear error/warning message when this happens
• Option to override if needed

Locate the mr sync entry point and the code that updates devenv.lock or flake.lock for peer repositories; the issue does not name specific files or tests. First trace how peer-repository commits are selected and determine the remote, branch, override, and path-input behavior before implementing detection and defining completion with a clear warning or error.