ExGitObjectstore.Fsck exists but isn’t wired into ReceivePack. A corrupt or malformed push currently lands on disk.

Scope

• ReceivePack.init/2 gains fsck: :strict | :permissive | :disabled opt.
• On receipt of a pack, validate every object before advancing any ref.
• Strict: reject push with side-band error message on any fsck finding.
• Permissive: warn via side-band, accept.
• Match git’s receive.fsckObjects config semantics.

Acceptance

• A push with a commit whose tree-sha points at nonexistent object is rejected (strict).
• Pushes with only cosmetic findings (e.g. missing email) are accepted in permissive mode with a side-band warning.