control: no write sequence leaves a half state !210

The four sequences from #108.

• Merge. UpdateRefCAS then MarkMerged; if the second failed the branch had moved while the merge request stayed open, and a retry was refused forever with "target already contains the MR head". A head the target already contains is now recorded as merged (strategy: recorded), which also covers a branch merged by hand and pushed. TestMergeRecordedWhenTargetContainsHead.
• Fork. CreateRepo then SetForkOf; a failure between them left a plain repository. CreateFork sets the parent in the insert. TestCreateForkSetsParent.
• Transfer. The revert after a failed directory move ignored its own error; it is reported now, naming the state left behind.
• Quota. The count and the insert were check-then-act with no lock; a process-wide mutex covers create, fork and import (import keeps its early fast-fail check and re-checks under the lock right before the insert, so the lock is never held across the clone).

Stacked on !209; no code dependency.

Closes #108