Bump go-git and go-billy to v6.0.0-beta.1

Also bumps testify to v1.12.1 and the indirect dependencies. The Go toolchain stays at 1.27.3, the current release.

go-git beta.1 dropped the leading-dash rule from ReferenceName.Validate to match git's check_refname_format: git restricts a leading dash only when a branch or tag is created, and fetch and clone replicate refs/heads/-foo. PartitionRefNames and --map validation defer to Validate, so such refs are now mirrored instead of skipped. The rejection was never a deliberate choice; it came with the validator. No ref name reaches a command line where a leading dash would be read as an option: the only exec use is git tag -s converted/<short> refs/heads/<short>.