Closes #1367

Context

pre-push changed-file detection fails on the initial push in repositories using sha256 object format.

Before this change, Lefthook tried to infer {push_files} from HEAD @{push} and, when no upstream existed yet, fell back to a hardcoded SHA-1 empty-tree object:

4b825dc642cb6eb9a060e54bf8d69288fbee4904

That object does not exist in sha256 repositories, so Lefthook failed before running configured pre-push commands.

I validated this both with automated coverage and against a real empty sha256 GitLab repository:

git@gitlab.com:supitsdu/lefthook-issue-1367.git

Real-world comparison:

• issue-1367 branch reproduces the failure:

  git diff --name-only HEAD 4b825dc642cb6eb9a060e54bf8d69288fbee4904
  fatal: ambiguous argument '4b825dc642cb6eb9a060e54bf8d69288fbee4904'
  echo PUSH {push_files} (skip) error replacing {push_files}: exit status 128
  error: failed to push some refs
  

• fixes-1367 branch succeeds against the same empty remote:

  PUSH README.md lefthook.yml
  To gitlab.com:supitsdu/lefthook-issue-1367.git
   * [new branch]      main -> main
  branch 'main' set up to track 'origin/main'
  

Changes

• Use Git's pre-push stdin ref updates as the source of truth for {push_files} when available.
• Parse stdin lines in the form:

  <local ref> <local oid> <remote ref> <remote oid>
  

• For new remote refs where remote oid is all zeroes, resolve pushed files with:

  git ls-tree -r --name-only <local oid>
  

• For existing remote refs, resolve pushed files with:

  git diff --name-only <remote oid> <local oid>
  

• Keep a fallback path for runs without pre-push stdin, but replace the hardcoded SHA-1 empty-tree fallback with:

  git ls-tree -r --name-only HEAD
  

• Add unit coverage for stdin-based push file resolution and the initial-push fallback path.
• Add an integration regression test for a sha256 repository performing its first push.

Validation performed:

• mise x go@1.26.0 -- make test
• targeted integration regression for pre_push_sha256_initial
• real push validation against an empty sha256 GitLab remote using binaries built from:
  • issue-1367
  • fixes-1367