feat(gitflow): remove the origin copy of a branch once its merge is verified

`gitflow_delete` now ends with `_gitflow_delete_remote`: after the local
copy is gone, the remote tip is read with `ls-remote --exit-code`, checked
against develop/main with the same ancestor test, and only then removed
with `push origin --delete`. Same contract as the pushes (BDR-095): best
effort, warn never fail. No origin, `GITFLOW_NO_PUSH=1` or
`gitflow.autopush false` skip it; an unreachable origin or a remote tip
holding commits the bases lack keeps the remote branch, loudly. A base is
never targeted, by construction and by an explicit guard.

The static deny on hand `git push --delete` stays: it matches the Bash
tool's command string, the lib is the sanctioned path. Prose (hard_deny,
environment), doctrine, gitflow SKILL (table, op, warning row),
SETTINGS.md and CHANGELOG updated. T24: 9 checks (finish removes the
copy, bases untouched, unmerged remote tip kept, never pushed silent,
unreachable origin loud, autopush opt-out). 161/163, the 2 failures are
the pre-existing T16a (gitleaks absent on this host).

CHANGELOG.md

@@ -10,7 +10,10 @@ Format follows [Keep a Changelog](https://keepachangelog.com/).
 - **Branch deletion guard** — `gitflow_delete` (also `gitflow.sh delete
   <branch>`) is the only path that deletes a branch: it refuses `main` and
   `develop` (rc 6) and any branch not merged into develop or main (rc 5),
-  with an explicit ancestor check, and keeps the branch. Motivation, proven
+  with an explicit ancestor check, and keeps the branch; the `origin/` copy
+  is removed right after, once its own tip passes the same check (a remote
+  tip the bases lack is kept, loudly; no origin, `GITFLOW_NO_PUSH=1` or
+  `gitflow.autopush false` skip it). Motivation, proven
   by `gitflow-test.sh` T22a: since `start` sets an auto-pushed upstream,
   `git branch -d` checks "merged into origin/<branch>", which the post-commit
   hook keeps trivially true. A fourth generated hook, `reference-transaction`,