Fast-forward local branch refs at the end of each poll cycle

Build worktrees share the primary checkout's .git, so build tools can read
refs/heads there. Since the rewrite never moved those refs, they stayed frozen at
the last checkout: hs.hsadmin.ng's prQuickCheck compares master with
origin/master and therefore failed every build once origin moved on.

The sync runs after the enqueue decision on purpose — a local ref lagging behind
origin is exactly how the watcher recognizes new commits, so keeping the refs in
sync earlier (cron job, mirroring refspec, or this step moved up) would silence
the branch instead of building it.

Fast-forward only, as a compare-and-swap against the commit just read: diverged
or ahead branches stay untouched, and the checked-out branch is advanced with
merge --ff-only, which refuses to overwrite conflicting uncommitted changes.
Switched off with watcher.fastForwardLocalRefs: false.

Co-Authored-By: Claude <noreply@anthropic.com>

src/main/kotlin/de/hoennig/gittally/config/GitTallyConfig.kt

@@ -107,6 +107,13 @@ data class WatcherConfig(
      * `.git/gittally/.gittally.yml` when the committed config enables the gates.
      */
     val pullRequestGate: Boolean = true,
+    /**
+     * At the end of each poll cycle, fast-forward the primary checkout's local branch
+     * refs to their origin counterparts, so build tools reading the shared `.git` see
+     * the same refs as origin. Fast-forward only: diverged or ahead local branches are
+     * never touched. Set false to leave the local branch refs alone entirely.
+     */
+    val fastForwardLocalRefs: Boolean = true,
 )
 
 data class BranchConfig(