feat(hardening): final sweep — security, performance, API consistency, docs

Security fixes -------------- - update_ref: add validate_branch_name() before constructing the ref path — prevents path traversal via crafted branch names (e.g. ../../etc/cron.d) - gc + config_cmd: sanitize_display() on the --format error path so ANSI escape sequences in bad --format values cannot reach the terminal - ls_files + commit_tree: validate_object_id() before passing user-supplied commit/snapshot IDs to read_commit()/read_snapshot() — closes path-traversal vector through the store's filename construction - verify_pack: fix unclosed file handle (open() without with statement)

Performance fixes ----------------- - show --json: read snapshot directly via commit.snapshot_id instead of re-reading the commit file we already have in memory; saves one disk read per JSON show invocation - commit_graph --ancestry-path: cap _ancestors_of() BFS at 100 000 commits (was completely unbounded); prevents O(N) pre-scan from stalling on large repositories

API consistency --------------- - ls_remote: replace --json bool flag with --format json|text, matching all 20+ peer plumbing commands; update test to use new flag - read_commit, read_snapshot, commit_tree, update_ref, unpack_objects: add --format text option so these always-JSON commands have a shell-pipeline- friendly human-readable output path; text modes print compact one-liners or are silent on success (update_ref) - commit_tree + ls_files: fix tests that used invalid hex IDs ('s'*64, 'snap2') so validate_object_id passes

Documentation fixes ------------------- - diff.py: BREAKING — docstring claimed JSON payload contains "ops" field; actual field is "total_changes". Agents consuming "ops" received nothing. - commit.py: add missing "author" and "sem_ver_bump" to JSON payload doc - log.py: add missing "sem_ver_bump" to JSON array element doc - reflog.py: add missing "index" and "author" to JSON entry doc - checkout.py: add missing "already_on" action value to JSON payload doc - rebase.py: document both JSON payload shapes (squash vs normal) - show.py: document all JSON fields including files_added/removed/modified - whoami.py: document full JSON payload fields - config_cmd show: document JSON payload top-level keys