Implement undo and redo as forward commits

GitHistoryProvider is the second HistoryProviding implementation:
its stack IS HEAD's first-parent ancestry, reseeded on load (redo
empty), re-synced to HEAD before every crossing so agents'
self-commits become the top and ⌘Z steps back exactly one commit;
any arriving commit clears redo (a heal-only window deliberately
does not). Restores are forward commits through the ordinary
signature path — GitRestoreOperation materializes only the
current-vs-target diff as working-tree writes and resolves no
reset/checkout symbol at all; heal commits are transparent
in-session (pointer passes over, restores exclude heal-owned paths,
identity carried on landed windows via PlannedCommit.kind →
GitLandedCommit). Subjects "Undo:/Redo: <crossed subject>"; menu
labels never nest in-session; the root commit is not a step
(crossing it would restore the empty tree).

Provider binding flips: makeHistoryProvider(store, tier, git) —
free binds native everywhere, Pro binds the git provider on git
boards and NOTHING on mode-none/repo-nested (the pair disables
through existing validation); add-git mid-session live-binds via
HistoryStore.didAddGit → bindHistoryProvider (the flip only ever
adds).

SessionSettleGate is the reusable Save All / Discard / Cancel step:
restores whose diff touches an open Edit session or raw-source
buffer gate on it (Save All applies with validation — a refused
buffer cancels the whole restore focused on the offender; Discard
reverts via CardBodyEditSession.discardBuffer and reconciles against
the working tree, deliberately skipping the second flush); untouched
sessions ride through undisturbed. Built for the branch-switch card
to reuse. BoardStore gains the async performWholesale sibling.

CardHistorySection fills the m6 EmptyView slot: read-only, newest
first, follows the card across lane moves by folder-component match
(the UUID is the identity — no rename detection), absent off git
mode and off Pro.

2332 tests / 403 suites green; InertGitTests untouched.

Claude-Session: https://claude.ai/code/session_01SR4XGjmBE16ZUYWpfFHXwY

Kanban/App/CloseFlushCoordinator.swift

@@ -42,11 +42,23 @@ public protocol CardSessionFlushing: AnyObject {
     /// template that silently missed those keystrokes would break 09's never-misses-keystrokes
     /// guarantee, which outranks the item's availability.
     var holdsUnsavedContent: Bool { get }
+
+    /// **This window's answers to the save-or-discard step** (06-history-undo.md ▸ Rules ▸ Undo
+    /// restore vs open Edit sessions; ▸ Branch switching), or `nil` for a window with nothing a
+    /// wholesale tree operation could disturb.
+    ///
+    /// Beside `holdsUnsavedContent` and deliberately not folded into it: that property answers "would
+    /// a *template copy* miss keystrokes", which is a read; this one carries the two writes — Save
+    /// All and Discard — that a restore or a branch switch needs the window to perform before it can
+    /// run on a settled tree. Same window, two different questions, and collapsing them would give
+    /// the settle step the draft-composer exemption `holdsUnsavedContent` deliberately makes.
+    var settlement: CardSessionSettlement? { get }
 }
 
 public extension CardSessionFlushing {
     func endSession() async {}
     var holdsUnsavedContent: Bool { false }
+    var settlement: CardSessionSettlement? { nil }
 }
 
 // MARK: - CloseFlushCoordinator