Partial writes without compensation in merge, fork, transfer and quota #108

• runMRMerge: UpdateRefCAS (mr.go:1099) then MarkMerged (:1102). If the second fails the branch has moved and the MR stays open; a retry refuses at :897 because the target already contains the head.
• runRepoFork: CreateRepo then SetForkOf (mr.go:103-109); a failure leaves a repo row without a directory.
• runRepoTransfer: the revert at repo.go:388, :393 ignores its own error.
• checkRepoQuota (repo.go:191) then CreateRepo is check-then-act with no lock.

Remedy: make MarkMerged idempotent when the head is already an ancestor of the target; put SetForkOf inside CreateRepo's transaction.