updateFile/createFile now return { sha, conflict } so 409/422 from GitHub can drive a UI flow instead of being swallowed as a generic save error. Also adds fetchLatestSha(path) for cheap freshness checks against HEAD.