Improve Gotsha sign-off and notes handling

[melounvitek]

Summary

• tighten sign-off and config handling so local verification does not succeed on the wrong commit and help/env overrides behave predictably
• make notes sync follow the branch's configured remote and tolerate repositories where the Gotsha notes ref does not exist yet
• clean up uninstall parity by removing the generated GitLab config alongside the existing Gotsha files

[melounvitek]

Requesting changes for one blocking security regression.

Fetch#remote and Push#remote now interpolate the current branch name directly into shell commands:

• git config --get branch.#{branch_name}.pushRemote
• git config --get branch.#{branch_name}.remote

Those strings are executed through BashCommand.run!, which shells out via bash -lc (lib/gotsha/bash_command.rb:21). Git accepts branch names containing shell metacharacters such as ;, $(), and quotes, so checking out a malicious branch can execute arbitrary local shell commands when gotsha fetch or gotsha push runs. Because gotsha push is called automatically from the installed pre-push hook (lib/gotsha/templates/git_hooks/pre-push:5), this becomes a realistic local code-execution path.

Please avoid building these commands with string interpolation. The safest fix is to stop invoking Git through a shell for these lookups and instead pass argv directly, or at minimum validate/escape the branch name before embedding it in the command.