fix(git-sync): EE-gate auto-pull UI, fork pull clone_ref, no-op push PR gate

- CE: the auto-pull and fork-PR toggles are disabled with an EE badge, and
  new sync repos only default them on when licensed (basic git sync is
  available on CE since #8493, but auto-pull is EE and the backend rejects it)
- The pull modal passes clone_ref for wm-fork- forks (wm-fork/<tracked>/<id>)
  so a manual pull fetches the fork branch instead of the tracked branch head
- PR-on-deploy skips no-op pushes: when the push script reports pushed=false
  (e.g. the deploy was caused by an auto-pull), the completion hook no longer
  ensures a PR, so closed PRs aren't recreated by the sync loop

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm

docs/git-sync-pull-design.md

@@ -453,6 +453,11 @@ Frontend:
   branch (fork branch wins, else the `wm_deploy/**` formula) and calls
   `ensure_pull_request`. Outbound with the installation token, so no webhook
   reachability is needed; app-backed repos only.
+- No-op pushes skip PR creation: the push script reports `pushed: false` when
+  nothing was committed (e.g. the deploy was itself caused by an auto-pull, so
+  the workspace already matches the repo), and the hook returns early — a PR
+  the user closed isn't recreated by the sync loop. Results without the flag
+  (older script pins) keep ensuring the PR.
 - Fork-branch routing edge cases (§7) hardened here.
 
 ### Phase 4 — PR diff preview checks (optional)