Fix nine defects in the push/sync path found in review

The worst was fatal: push passed --skip-prod-check to upload-prebuilt, which
forwards every argument to sign, promote and update as well, and sign rejects
unknown options. Every non-dry-run push and deploy would have uploaded and
verified its artifacts and then failed before signing. upload-prebuilt now
routes publishing flags to sync alone.

The partial-tree guard was weaker than it looked:

  - it counted archive files locally against package names in the remote
    database, and this tree keeps two versions per package, so a checkout with
    a spare version of half the repository could pass while still hiding
    hundreds of packages. It now compares package-name sets and lists what
    would be hidden.
  - it treated any unreadable remote as an empty one, so an auth failure or a
    corrupt database disabled it. Only rclone's "directory not found" now
    counts as a fresh mirror; every other failure aborts.

Also:

  - sync had no set -e, so a failed package upload fell through to publishing
    the database, advertising packages that were never uploaded. Each transfer
    is now checked before the next step.
  - --package with no names silently meant "every package", which under --yes
    could publish everything from one unset variable in a script.
  - push now refuses to run when the host has packages staged from an earlier
    failure, since publishing would sign and promote those too.
  - epoch versions contain a colon, which rsync reads as host:path, so no
    package with an epoch could be transferred. Sources are ./-prefixed.
  - remote paths are quoted for the remote shell.
  - sync spun forever on a missing option value.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

bin/upload-prebuilt

@@ -5,7 +5,28 @@ set -e
 
 SCRIPT_DIR=$(realpath "${BASH_SOURCE[0]%/*}")
 
-"$SCRIPT_DIR/repo" sign "$@"
-"$SCRIPT_DIR/repo" promote "$@"
-"$SCRIPT_DIR/repo" update "$@"
-"$SCRIPT_DIR/repo" sync "$@"
+# Only sync understands the publishing flags; sign, promote and update reject
+# unknown options outright, so they cannot be forwarded blindly.
+COMMON_ARGS=()
+SYNC_ARGS=()
+while [[ $# -gt 0 ]]; do
+  case $1 in
+  --skip-prod-check | --prune)
+    SYNC_ARGS+=("$1")
+    shift
+    ;;
+  --remote)
+    SYNC_ARGS+=("$1" "$2")
+    shift 2
+    ;;
+  *)
+    COMMON_ARGS+=("$1")
+    shift
+    ;;
+  esac
+done
+
+"$SCRIPT_DIR/repo" sign "${COMMON_ARGS[@]}"
+"$SCRIPT_DIR/repo" promote "${COMMON_ARGS[@]}"
+"$SCRIPT_DIR/repo" update "${COMMON_ARGS[@]}"
+"$SCRIPT_DIR/repo" sync "${COMMON_ARGS[@]}" "${SYNC_ARGS[@]}"