fix(git): the interval fetches one run per folder, and the rest of the review (review)

The scheduler is the part that runs with nobody watching, so it is decided per folder
rather than per session: sessions sharing a folder are the same clone and share one run
that both see, `inFlight`/`lastRunAt` are keyed by the resolved folder, the schedule is
stamped when a folder is picked instead of when its run starts, and a tick is skipped
while the previous one is still going. The click route joins a run already going for the
same folder rather than starting a second fetch in one clone.

The tick keeps ONE bound for the git processes of the whole run and hands it to every
folder, and bounds its folders with a bound of its own: the same semaphore cannot serve
both levels, because a folder holding a slot would then wait for a slot its own fetch
needs. Both bounds are `FETCH_CONCURRENCY`, so the ceiling is unchanged. The bound claim
in CLAUDE.md, the `Limiter` jsdoc and docs/api-reference.md now describes it as it is.

Before anything is fetched the folder is probed with the bounded path probe, so a case on
a mount that stopped answering is skipped and never touched.

The rest of the review: the hooks are named as they really are (`reference-transaction`,
`pre-auto-gc` through the maintenance a fetch triggers, config commands such as
`credential.helper`) and `FETCH_CONFIG_ARGS` turns maintenance and gc off for an
unattended run; the claim that an agent in the same repository is not disturbed is
replaced by the ref-lock collision it actually is; the click route publishes its own run
as `trigger: 'click'`; `autoSaveGitFetch` uses `_apiJson` so a 400 shows the error toast
and applies the returned settings; and the two wording fixes.

Tests: the scheduler pins one run per folder, the two bounds, the probe before anything
runs, and that closing the session holding the override keeps the folder while another
session is still open on it; the route test pins the click publish and the join, asserting
the join before the held run is released — releasing first lets the run finish and clears
the lane, so the joiner would be entitled to its own fetch and the test would pass for the
wrong reason.

docs/wiki/Settings-Reference.md

@@ -93,11 +93,13 @@ Git window lists, so the `behind` number is current without a click, and **Git f
 the start of a run, so a slow repository does not push the next one out. These are the only Git settings
 that are synced rather than per device, because the server's scheduler is what acts on them: kept per
 device, the scheduler would read nobody's number. **Session Options → Git** overrides both the switch and
-the interval for one case, and that override wins even while the app switch is off; a case that follows the
-app shows the app's values and its rows go inert until you turn **Follow the app setting** off. Nothing is
-ever fetched for a Docker or remote (SSH) case, and a repository a container can write to is refused
-before any git runs. Both default to off because `git fetch` is the one git command Codeman runs that
-writes, and the one that runs a repository's own hooks.
+the interval for one session, and that override wins even while the app switch is off; a session that follows
+the app shows the app's values and its rows go inert until you turn **Follow the app setting** off. Nothing is
+ever fetched for a Docker or remote (SSH) session, and a repository a container can write to is refused
+before any git runs. Sessions open on the same folder share one run. Both default to off because `git fetch`
+is the one git command Codeman runs that writes, and the one that can run a repository's own hooks
+(`reference-transaction`, `pre-auto-gc` through the maintenance a fetch triggers, and config commands such as
+`credential.helper`).
 
 Most default to off. The stock desktop header is system stats, File Viewer, Tiles, and the gear.
 **Header Stats Style** picks how the system stats and plan usage are drawn: *Compact*

docs/wiki/Working-With-Files.md

@@ -248,14 +248,18 @@ Click it for a draggable window, in the style of the File Viewer:
 - **Fetch** in the header runs `git fetch` for the repositories the window lists, on your click; the
   window then re-reads, so "behind" is as of that fetch. A repository that could not be fetched keeps
   its row and shows why. **Git fetch on an interval** (Settings → Bottom bar, off by default) runs the
-  same fetch on a timer for every case that is on, and **Session Options → Git** overrides both the
-  switch and the interval for one case — a case that turned itself on runs even while the app-wide
-  switch is off, and nothing is ever fetched for Docker or remote (SSH) cases.
+  same fetch on a timer for every session that is on, and **Session Options → Git** overrides both the
+  switch and the interval for one session — a session that turned itself on runs even while the app-wide
+  switch is off, sessions open on the same folder share one run, and nothing is ever fetched for Docker or
+  remote (SSH) sessions.
 
 It is read-only apart from that fetch: Codeman never commits, checks out or changes the
 repository, and `git fetch` writes remote-tracking refs only — it is the one git command here that
-writes, and the one that runs a repository's own hooks, which is why nothing runs on a timer until you
-opt in. It is not shown for Docker or remote (SSH) sessions, and a repository at or inside a Docker case
+writes, and the one that can run a repository's own hooks (`reference-transaction`, `pre-auto-gc` through the
+maintenance a fetch triggers, and config commands such as `credential.helper`), which is why nothing runs on
+a timer until you opt in. A fetch holds git's ref lock, so an agent's own `git pull` in the same repository
+can hit the same `cannot lock ref`, and a folder is fetched by one run at a time. It is not shown for Docker
+or remote (SSH) sessions, and a repository at or inside a Docker case
 workspace is skipped even from a local session, before any git runs (a container can write there,
 and git would run that repository's own configuration on the host). Fetch asks nothing of you: it
 uses the sign-in your own git already has, and it gives up quickly rather than waiting on an