lifecycle: add git_delete_ref

The deploy subtree parks its rollback state in a git ref and has to drop
it again on both the success and the compensated path.

hive-c0re/src/lifecycle/git.rs

@@ -167,3 +167,13 @@ pub async fn git_read_tree_reset(dir: &Path, target: &str) -> Result<()> {
 pub async fn git_update_ref(dir: &Path, refname: &str, target: &str) -> Result<()> {
     git(dir, &["update-ref", refname, target]).await
 }
+
+/// Delete a ref. The counterpart to [`git_update_ref`] for the bookkeeping
+/// refs a deploy parks in the applied repo (`refs/hyperhive/rollback/<id>`,
+/// which records the pre-merge `main` so the deploy tail can compensate a
+/// merge that landed but never finalized). `update-ref -d` is a no-op-free
+/// delete: it errors if the ref does not exist, so callers that treat absence
+/// as "nothing to undo" should check with [`git_rev_parse`] first.
+pub async fn git_delete_ref(dir: &Path, refname: &str) -> Result<()> {
+    git(dir, &["update-ref", "-d", refname]).await
+}

hive-c0re/src/lifecycle/mod.rs

@@ -7,8 +7,8 @@ mod setup;
 mod tests;
 
 pub use git::{
-    git, git_command, git_read_tree_reset, git_rev_parse, git_tag, git_tag_annotated,
+    git, git_command, git_delete_ref, git_read_tree_reset, git_rev_parse, git_tag,
-    git_update_ref,
+    git_tag_annotated, git_update_ref,
 };
 pub use host_config::write_dropins;
 pub use setup::{