Summary

• Add update_hook (per-ref, can reject individual refs) and post_receive_hook (after all updates, for notifications/CI triggers) to receive-pack
• Follows the same pluggable function pattern as the existing pre_receive_hook

Closes #9

Hook execution order

1. pre_receive_hook(commands) — all-or-nothing, rejects entire push
2. update_hook(ref, old_sha, new_sha) — per-ref, rejection blocks only that ref
3. Ref updates applied
4. post_receive_hook(changes) — receives full change list with statuses, failures logged but don’t affect result

Test plan

• update_hook called per-ref with correct arguments
• update_hook rejection blocks only the affected ref, others succeed
• post_receive_hook called with full change list including statuses
• post_receive_hook includes rejected refs in changes
• post_receive_hook failure doesn’t affect push result
• post_receive_hook not called when pre_receive_hook rejects
• No hooks configured works as before
• 556 tests pass, dialyzer clean