fix: pre-landing review for store-format-v2 (verify-window orphan, copy-forward push, --force, comment)

Pre-landing review (1 critical, 4 informational):
- CRITICAL: per-project `secrets verify` during the migration window flagged
  the freshly-written v2 twin as a spurious orphan and exited 1 (store still
  reads v1, so verify's expected set only held the .gradle-properties.age name).
  Breaks the documented migrate->verify->finalize workflow and CI. Fix: verify's
  orphan set now accounts for BOTH suffix forms of a properties external, so the
  twin is never a false orphan mid-migration. Regression test added.
- Copy-forward now pushes the twins (mirrors push/rekey) so a --finalize on
  another machine sees them; previously twins were local-only until finalize,
  a multi-machine footgun.
- Dropped the undocumented `--force` alias (keep `--yes`).
- Clarified the EGB-700 comment (which-format line, folded into EGB-703).

Deferred to EGB-701: the two finalize find-walks over *.gradle-properties.age
could collapse to one pass. Full suite 236/236.

test/migrate.bats

@@ -241,6 +241,21 @@ m_file_src()   { mkdir -p "$HOME/keystores"; printf 'KS\x00\x01\x02\xffDATA\n' >
   [ ! -f "$SECRETS_DIR/.secrets-format" ]
 }
 
+@test "verify is green during the migration window (v2 twin is not a spurious orphan)" {
+  # Regression: after copy-forward the store is still v1, so verify computed the
+  # external blob path as .gradle-properties.age and flagged the .properties.age
+  # twin as an orphan, failing verify mid-migration. The orphan set now accounts
+  # for both suffix forms.
+  make_v1_store
+  m_gradle_src $'beaconClerkPkTest=pk_test_abc\n'
+  create_project_dir windowverify
+  printf 'gradle-properties ~/.gradle/gradle.properties beaconClerkPkTest\n' > .secrets-files
+  "$SECRETS_BIN" push windowverify >/dev/null 2>&1
+  "$SECRETS_BIN" migrate >/dev/null 2>&1
+  run "$SECRETS_BIN" verify windowverify
+  [ "$status" -eq 0 ]
+}
+
 @test "v1 client still reads during the migration window (after copy-forward, before finalize)" {
   make_v1_store
   m_gradle_src $'beaconClerkPkTest=pk_test_abc\n'