feat(FN-5359): add push-to-origin button and hook to merge advance notice

Adds a push-to-origin workflow to the merge notice system, introducing a new `useMergeAdvanceNotice` hook, a `merge-advance-push-origin` route handler, and corresponding UI affordance in the `MergeAdvanceNotice` banner component. The engine gains TOCTOU and refusal audit assertions, and coverage exp

Fusion-Task-Id: FN-5359

Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
Fusion-Task-Id: FN-5359

packages/engine/src/run-audit.ts

@@ -273,6 +273,24 @@ export type GitMutationType =
    * ```
    */
   | "pull:fast-forward"
+  /**
+   * Metadata shape:
+   * ```ts
+   * {
+   *   integrationBranch: string;
+   *   remote: "origin";
+   *   localSha: string;
+   *   remoteSha: string | null;
+   *   aheadCount: number;
+   *   behindCount: number;
+   *   forceWithLease: boolean;
+   *   outcome: "ok" | "rejected-non-ff" | "rejected-other" | "no-upstream" | "no-remote" | "merge-locked" | "failed";
+   *   stderrPreview?: string;
+   *   durationMs: number;
+   * }
+   * ```
+   */
+  | "push:origin"
   /**
    * Metadata shape:
    * ```ts