Identity hook: a push refspec it cannot read is refused #103

Part of the epic "Epic: slice 0, foundations. The repo holds the line, its context is tested, and the platform facts are recorded".

Why. The identity hook says it reads every commit a push sends, and what it cannot read it refuses. The review of "Session hooks: git options that run a program, or move a local branch" (#90) found that a push whose refspec is a variable or a command substitution passes the hook even when it carries another person's commit:

• X=side; git push origin $X:refs/heads/x
• git push origin $(git rev-parse side):refs/heads/x
• git push origin "$(…)":refs/heads/x, and the backtick form

A plain side:refs/heads/x is refused correctly, and so are pushes of stash commits.

Done when

• A push refspec the hook cannot resolve to a ref or commit it reads (a variable, a command substitution, a glob it does not expand) is refused, with a code, in tools/hooks/identity.py.
• A test for each spelling above, and one that a variable the hook knows (set earlier in the same command to a plain ref) is still read.
• Decision 0016 and the hook's docstring say exactly what the hook reads.