Remote includes: refresh command + `clean --cache` purge

[no0dles]

What to build

Implement the on-demand refresh path for remote includes (using the command name settled in #20). The refresh/pull command re-fetches remote references, picking up the latest commit for a mutable ref (branch/tag); a SHA-pinned reference does not change (the SHA is immutable). hammerkit clean --cache also purges cached remote references so the next run re-fetches them. Together these are the only ways a cached mutable-ref include is updated (the cache is otherwise the stable pin). Builds on the git-source resolution + reference cache from #26.

References: specs/remote-includes/spec.md (US3, FR-004); docs/adr/0004.

Acceptance criteria

• The refresh/pull command updates a cached mutable-ref reference to the latest upstream commit (SC-003).
• A SHA-pinned reference is unchanged by the refresh command (immutable).
• hammerkit clean --cache purges cached remote references, forcing the next run to re-fetch (SC-003).

Blocked by

• [HITL] Remote includes: settle refresh-command name & git-source syntax #20 (remote-include command name decision)
• Remote includes: resolve git-source references/includes (cache-as-pin, offline) #26 (git-source resolution + reference cache)