Open upstream PR for gix-stash to GitoxideLabs/gitoxide

[mxaddict]

Now that #44 is functionally closed (krypt uses a personal fork at mxaddict/gitoxide@feat/gix-stash), we owe the upstream a PR so we can switch back to a crates.io release.

Fork state

• 8 commits on feat/gix-stash covering scaffold → list → push → pop → semantic-fix → tests → CHANGELOG
• New crate gix-stash (version 0.0.0)
• Wired into top-level gix as the stash feature
• 14 integration tests passing
• #![deny(missing_docs)] clean, -D warnings clean

MVP scope shipped

• stash_push — captures WT (not just index) + resets WT to HEAD + removes untracked when include_untracked
• stash_pop — real 3-way merge via gix_merge::tree, conflict-preserving ref drop, parent[2] untracked restore
• stash_list — reflog walk newest-first

Pre-PR checklist

• Squash / rewrite history if upstream prefers fewer commits (the current 8-commit shape may be acceptable; check their PR conventions)
• Open an upstream issue first to gauge interest (gitoxide convention — they often want discussion before a feature crate PR)
• Add upstream's cargo-smart-release metadata if missing
• Write the PR description with AI-assistance disclosure per their CONTRIBUTING.md
• Resolve the known limitations in the gix-stash CHANGELOG (smudge-filter wiring, deletion handling, index timestamp preservation) — these were acceptable for our fork but reviewers may want them addressed
• Confirm rebase against upstream/main is clean

Long-tail (probably reviewer requests)

• Implement the rest of the operations (apply, drop, show, branch, autostash) — currently deferred. Upstream may not accept stash as a 3-op crate.
• Porcelain wrappers in gix::Repository (stash_push, stash_pop, stash_list)
• Convert the test fixtures to upstream's archive-tarball format

Why this matters

Until the PR merges (and gix crates.io pulls in stash), krypt-bin builds from a git dep — breaks cargo install krypt-cli from crates.io (it can't resolve a git-sourced transitive dep). Distribution channels (AUR, Homebrew) currently work because they're source-build pipelines.

Related: #37 (krypt crate name on crates.io).

[mxaddict]

Superseded by the actual PR being opened: GitoxideLabs/gitoxide#2603. Tracking continues there.