fix: fail the deploy instead of masking reconcile restore errors

Addresses review feedback on the concurrent-deploy reconcile logic. The
authoritative restore commands in reconcile_owned_paths previously used
`|| true`, so if restoring an owned documentation path failed, the action
would silently stage and commit a deletion and publish broken/missing docs.

- Owned purge/keep paths always exist in the deploy commit, so their
  `git checkout`/`git add` restores are now unmasked: a failure fails the
  job under `set -e` instead of committing a silent deletion. Only the
  best-effort pre-clean `git rm --ignore-unmatch` stays lenient.
- The "latest" yield path only restores from the remote when the remote
  actually publishes it (guarded by `git ls-tree`); otherwise the staged
  removal stands, avoiding an abort on a now-absent pathspec. The
  `git ls-tree` check is unmasked so an invalid FETCH_HEAD fails closed.

Assisted-by: claude-code:claude-4.8-opus