lifecycle: fetch into checked-out main with --update-head-ok

setup_applied does `git init --initial-branch=main` then
`git fetch <proposed> main:refs/heads/main` to seed the
applied repo with proposed's initial commit. git's default
safeguard refuses to fetch into the currently-checked-out
branch, even though the working tree is empty (we just init'd).
add --update-head-ok to bypass — the read-tree-reset
immediately after fetches the right state, so the safeguard
the flag bypasses isn't relevant here anyway.

repro from the user: spawn of 'dmatrix' failed with
  fatal: refusing to fetch into branch 'refs/heads/main'
  checked out at '/var/lib/hyperhive/applied/dmatrix'

hive-c0re/src/lifecycle.rs

@@ -428,7 +428,18 @@ pub async fn setup_applied(
         let proposed_str = proposed.display().to_string();
         git(
             applied_dir,
-            &["fetch", "--no-tags", &proposed_str, "main:refs/heads/main"],
+            // --update-head-ok lets us fetch into refs/heads/main while
+            // HEAD still points there. git's default safeguard refuses
+            // to avoid index/working-tree desync, but the working tree
+            // is empty (we just `init`'d) and we read-tree-reset right
+            // after, so the safeguard is moot here.
+            &[
+                "fetch",
+                "--no-tags",
+                "--update-head-ok",
+                &proposed_str,
+                "main:refs/heads/main",
+            ],
         )
         .await?;
         git_read_tree_reset(applied_dir, "refs/heads/main").await?;