Document/handle the force-push semantics of `venfork-config` for consumers

[cabljac]

Context

Venfork updates the venfork-config orphan branch with --force-with-lease=venfork-config:<read-sha> (per the README's concurrency section). That makes the branch effectively force-pushed to origin after every config-mutating command (stage --pr, pull-request, issue stage, issue pull, sync upstream-pr/<n>).

Any tool that reads venfork-config from a long-lived clone (downstream automation, CI, bots) hits a sharp edge: a plain git fetch origin venfork-config:venfork-config is rejected as non-fast-forward after every venfork update, leaving the local ref at a stale state with no warning.

Repro

In a venfork clone with an existing venfork-config local ref:

1. From another machine, run venfork issue pull <N> against the same mirror — venfork force-pushes venfork-config.
2. From the original clone:

   git fetch origin venfork-config:venfork-config
   

   exits 1 with ! [rejected] venfork-config -> venfork-config (non-fast-forward).
3. git show venfork-config:.venfork/config.json returns the OLD config — the new pulledIssues entry is missing.

How I hit it

Built honey — an autonomous triage bot that consumes venfork-config.pulledIssues to dedupe upstream-issue-pull operations. After honey ran venfork issue pull and re-read the config, it consistently saw stale data and assumed the pull had failed ("venfork issue pull reported success but no pulledIssues entry on re-read"). Real cause was the non-fast-forward fetch.

Suggested fix

Two options, not mutually exclusive:

1. Document in the README's concurrency section that consumers must use +venfork-config:venfork-config (or git fetch -f) to keep their local ref in sync — i.e. that the ref is rebased/replaced, not appended to.
2. Surface a venfork-side helper / library export for reading the config that handles the force-fetch internally, so downstream tools don't each have to figure this out independently.

In honey we just changed our `readVenforkConfig` helper to use `+venfork-config:venfork-config` — one-character fix once you know.

Current workaround

Always pass `+` when fetching the config branch, or run `git fetch --force origin venfork-config`.