sketch: "git push" button

Ultimately, we want to allow users to push their changes to github, and
thereby do a good chunk of work without resorting to the terminal (and
figuring out how to move the git references around, which requires a
bunch of esotiric and annoying expertise).

This commit introduces:

1. For outtie's HTTP server (which is now comically Go HTTP ->
   CGI-effing-bin -> git -> shell script -> git in this case), there's a
   custom git hook that forwards changes to refs/remotes/origin/foo to
   origin/foo. This is a git proxy of sorts. By forwarding the
   SSH_AUTH_SOCK, we can use outtie's auth options without giving innie
   the actual credentials. This works by creating a temporary directory
   for git hooks (for outtie).

2. Innie sets up a new remote, "upstream" when a "passthrough-upstream"
   flag is pasksed. This remote kind of looks like the real upstream (so
   upstream/foo) is fetched. This will let the agent handle rebases
   better.

3. Innie exposes a /pushinfo handler that returns the list of remotes
   and the current commit and such. These have nice display names for
   the outtie's machine and github if useful.

   There's also a /push handler. This is the thing that knows about the
   refs/remotes/origin/foo thing. There's no magic git push refspec that
   makes this all work without that, I think. (Maybe there is? I don't
   think there is.)

   Note that there's been some changes about what the remotes look like,
   and when we use the remotes and when we use agent.GitOrigin().
   We may be able to simplify this by using git's insteadof
   configurations, but I think it's fine.

4. The web UI exposes a button to push, choose the remote and branch,
   and such. If it can't do the push, you'll get a button to try to get
   the agent to rebase.

   We don't allow force pushes in the UI. We're treating those
   as an advanced feature, and, if you need to do that, you can
   figure it out.

This was collaboration with a gazillion sketch sessions.
diff --git a/loop/server/loophttp_test.go b/loop/server/loophttp_test.go
index c6d4b6b..04a18ba 100644
--- a/loop/server/loophttp_test.go
+++ b/loop/server/loophttp_test.go
@@ -3,6 +3,7 @@
 import (
 	"bufio"
 	"context"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"slices"
@@ -245,6 +246,7 @@
 func (m *mockAgent) OutsideWorkingDir() string                   { return "/app" }
 func (m *mockAgent) GitOrigin() string                           { return "" }
 func (m *mockAgent) GitUsername() string                         { return m.gitUsername }
+func (m *mockAgent) PassthroughUpstream() bool                   { return false }
 func (m *mockAgent) OpenBrowser(url string)                      {}
 func (m *mockAgent) CompactConversation(ctx context.Context) error {
 	// Mock implementation - just return nil
@@ -678,3 +680,130 @@
 
 	t.Log("State endpoint includes port information correctly")
 }
+
+// TestGitPushHandler tests the git push endpoint
+func TestGitPushHandler(t *testing.T) {
+	mockAgent := &mockAgent{
+		workingDir:   t.TempDir(),
+		branchPrefix: "sketch/",
+	}
+
+	// Create the server with the mock agent
+	server, err := server.New(mockAgent, nil)
+	if err != nil {
+		t.Fatalf("Failed to create server: %v", err)
+	}
+
+	// Create a test HTTP server
+	testServer := httptest.NewServer(server)
+	defer testServer.Close()
+
+	// Test missing required parameters
+	tests := []struct {
+		name           string
+		requestBody    string
+		expectedStatus int
+		expectedError  string
+	}{
+		{
+			name:           "missing all parameters",
+			requestBody:    `{}`,
+			expectedStatus: http.StatusBadRequest,
+			expectedError:  "Missing required parameters: remote, branch, and commit",
+		},
+		{
+			name:           "missing commit parameter",
+			requestBody:    `{"remote": "origin", "branch": "main"}`,
+			expectedStatus: http.StatusBadRequest,
+			expectedError:  "Missing required parameters: remote, branch, and commit",
+		},
+		{
+			name:           "missing remote parameter",
+			requestBody:    `{"branch": "main", "commit": "abc123"}`,
+			expectedStatus: http.StatusBadRequest,
+			expectedError:  "Missing required parameters: remote, branch, and commit",
+		},
+		{
+			name:           "missing branch parameter",
+			requestBody:    `{"remote": "origin", "commit": "abc123"}`,
+			expectedStatus: http.StatusBadRequest,
+			expectedError:  "Missing required parameters: remote, branch, and commit",
+		},
+		{
+			name:           "all parameters present",
+			requestBody:    `{"remote": "origin", "branch": "main", "commit": "abc123", "dry_run": true}`,
+			expectedStatus: http.StatusOK, // Parameters are valid, response will be JSON
+			expectedError:  "",            // No parameter validation error
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			resp, err := http.Post(
+				testServer.URL+"/git/push",
+				"application/json",
+				strings.NewReader(tt.requestBody),
+			)
+			if err != nil {
+				t.Fatalf("Failed to make HTTP request: %v", err)
+			}
+			defer resp.Body.Close()
+
+			if resp.StatusCode != tt.expectedStatus {
+				t.Errorf("Expected status %d, got: %d", tt.expectedStatus, resp.StatusCode)
+			}
+
+			if tt.expectedError != "" {
+				body, err := io.ReadAll(resp.Body)
+				if err != nil {
+					t.Fatalf("Failed to read response body: %v", err)
+				}
+				if !strings.Contains(string(body), tt.expectedError) {
+					t.Errorf("Expected error message '%s', got: %s", tt.expectedError, string(body))
+				}
+			}
+		})
+	}
+}
+
+// TestGitPushInfoHandler tests the git push info endpoint
+func TestGitPushInfoHandler(t *testing.T) {
+	mockAgent := &mockAgent{
+		workingDir:   t.TempDir(),
+		branchPrefix: "sketch/",
+	}
+
+	// Create the server with the mock agent
+	server, err := server.New(mockAgent, nil)
+	if err != nil {
+		t.Fatalf("Failed to create server: %v", err)
+	}
+
+	// Create a test HTTP server
+	testServer := httptest.NewServer(server)
+	defer testServer.Close()
+
+	// Test GET request
+	resp, err := http.Get(testServer.URL + "/git/pushinfo")
+	if err != nil {
+		t.Fatalf("Failed to make HTTP request: %v", err)
+	}
+	defer resp.Body.Close()
+
+	// We expect this to fail with 500 since there's no git repository
+	// but the endpoint should be accessible
+	if resp.StatusCode != http.StatusInternalServerError {
+		t.Errorf("Expected status 500, got: %d", resp.StatusCode)
+	}
+
+	// Test that POST is not allowed
+	resp, err = http.Post(testServer.URL+"/git/pushinfo", "application/json", strings.NewReader(`{}`))
+	if err != nil {
+		t.Fatalf("Failed to make HTTP request: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusMethodNotAllowed {
+		t.Errorf("Expected status 405, got: %d", resp.StatusCode)
+	}
+}