fix(git): fetch origin base before creating a new workspace branch

[Zeus-Deus]

Closes #76

Problem

When creating a new workspace branch, the base is resolved against origin/<base> — but nothing fetched first, so the ref was whatever the last fetch left behind. New agent workspaces could start from stale code and create avoidable merge conflicts. The headless daemon path didn't even prefer the remote ref.

Changes

• src-tauri/src/git.rs: new fetch_origin_branch() — scoped git fetch --quiet --no-tags origin <base> with GIT_TERMINAL_PROMPT=0, a 10s kill-on-timeout cap (matches the sidebar divergence fetcher), origin/ prefix normalization, and a cheap skip when the repo has no origin remote. Called in git_create_worktree's new-branch path before find_remote_ref, so the existing "latest remote commit" intent is now actually achieved. All failures are swallowed — offline / no-remote repos fall back to the existing origin/<base> ref, else the local branch; creation never hard-fails.
• src-tauri/src/remote/git.rs: parity for the headless daemon's worktree_create path — same scoped fetch plus a find_remote_ref mirror, so daemon-created branches also prefer a freshly-fetched origin/<base> instead of the local ref verbatim.
• docs/features/workspace-creation.md: documented the base-resolution policy.
• The calling Tauri commands already run git_create_worktree under spawn_blocking, so the fetch never blocks the UI thread.

Acceptance criteria

• New workspace branches are created from a freshly-fetched origin/<base> when a reachable remote exists
• Offline / no-remote repos still create workspaces (graceful fallback, no hard error)
• Fetch runs off the main thread (no UI freeze) — spawn_blocking in commands/workspace.rs and commands/git.rs
• Fetch is scoped to the base ref (--no-tags, single branch)

Testing

8 new integration tests with real git remotes (bare origin + stale clone + publisher clone):

• New branch starts at the freshly-fetched remote tip when local origin/main is stale (desktop + daemon paths)
• Unreachable remote → graceful fallback to the stale origin/<base>, creation succeeds (both paths)
• No-remote repo → local base used, fetch skipped; absolute/empty refs skipped

End-to-end against the real codemux-remote binary with a networked git server (git daemon in a docker container over git://):

• Local clone deliberately 1 commit behind → worktree_create via the daemon HTTP tool API produced a worktree at the true remote tip, not the stale ref
• Git server stopped → creation succeeded in 66 ms from the fallback ref
• Black-hole remote (accepts TCP, never responds) → creation completed in 10.04 s, proving the timeout cap kills the fetch instead of hanging worktree creation

cargo check, cargo test (1690 passed; the only 2 failures are pre-existing machine-environment artifacts, verified identical on a clean tree), npm run check, npm run test (1824 passed) all green.