Bring repository in line with the deployed server

Commits the changes already running in production (image rodecomp/server:adminreview-20261028), which were never pushed:

- Repository sync before verification: with pushRemote set, the worker fast-forwards its checkout at idle cohort boundaries, blocks merge/check lanes while a sync is pending or failed, and reloads data/decomp.json, the compile commands and data/toolchain.lock.json from one committed snapshot; the web process adopts only the published snapshot (git.js, verify.js, merge.js, checks.js, maintenance.js, project.js, app.js).
- Symbol corrections: POST /api/admin/symbols/:id accepts decorated and swapDecoratedWith with strict validation, records old/new values, and invalidates cached symbol snapshots; td maintenance symbol --decorated/--swap-decorated-with and MCP td_correct_symbol (cli.js, mcp.js, ops.js, app.js).
- Downloads: /download/ responses are no-store and answer HEAD; self-update revalidates the manifest and fetches the binary with ?sha256= to bypass stale CDN entries (update.js, app.js).
- deploy/rodecomp/compose.yaml: Forgejo SSH enabled on port 22 (SSH_DOMAIN 192.168.1.77), as running.

Tests: repo-sync, symbol-corrections and update suites added; npm test passes (164).

deploy/rodecomp/compose.yaml

@@ -42,7 +42,10 @@ services:
       USER_GID: "1000"
       FORGEJO__server__ROOT_URL: "https://clank.rodecomp.online/git/"
       FORGEJO__server__DOMAIN: "clank.rodecomp.online"
-      FORGEJO__server__DISABLE_SSH: "true"
+      FORGEJO__server__DISABLE_SSH: "false"
+      FORGEJO__server__SSH_PORT: "22"
+      FORGEJO__server__SSH_LISTEN_PORT: "22"
+      FORGEJO__server__SSH_DOMAIN: "192.168.1.77"
       FORGEJO__server__OFFLINE_MODE: "true"
       FORGEJO__server__LANDING_PAGE: "explore"
       FORGEJO__database__DB_TYPE: "sqlite3"
@@ -56,6 +59,8 @@ services:
       FORGEJO__actions__ENABLED: "false"
       FORGEJO__packages__ENABLED: "false"
       FORGEJO__repository__DISABLED_REPO_UNITS: "repo.pulls,repo.actions,repo.packages,repo.releases,repo.projects"
+    ports:
+      - "22:22"
     volumes:
       - forgejo:/data
     restart: unless-stopped