refactor(trail): let the server decide bare-number update guards

The bare-number guard scanned up to 2,000 trails for the checked-out branch before writing. The project trail update now carries the branch and repository id with branch_check=required, and the trail's cell refuses atomically when the branch's work, live or merged, belongs to another trail, or when it cannot compare. The CLI refuses locally only where nothing checkable can be sent (detached HEAD, a repository that does not resolve or is processed in another cell, values the server would reject), words both refusals with the same reruns as before, keeps the change-number hint from the server's change_number, and notes on stderr when a server does not confirm the check. The trail scan refactor is reverted.