fix(health): suppress 404 when health monitor disabled + fix audit test assertion

- Sidebar.svelte: defer healthStore.refresh() until feature flags confirm
  health_monitor is enabled; skip entirely when disabled
- health.js: remove throw error from catch block — log and return null
  instead, preventing 'Uncaught (in promise)' on expected 404
- test_report_audit_immutability.py: fix mock assertions —
  audit_service uses logger.reason/reflect/explore, not logger.info
- HealthStore and Sidebar now produce zero network noise when
  FEATURES__HEALTH_MONITOR=false

backend/src/services/git/_sync.py

@@ -1,6 +1,6 @@
-# #region GitServiceSyncMixin [C:3] [TYPE Module] [SEMANTICS git, sync, push, pull, remote]
+# #region GitServiceSyncMixin [C:4] [TYPE Module] [SEMANTICS git, sync, push, pull, remote, lock]
 # @LAYER: Infra
-# @BRIEF Push and pull operations for GitService with origin host auto-alignment.
+# @BRIEF Push and pull operations for GitService with origin host auto-alignment (concurrent-safe).
 # @RELATION USED_BY -> [GitService]
 # @RELATION DEPENDS_ON -> [GitServiceUrlMixin]
 
@@ -17,13 +17,14 @@ from src.models.git import GitRepository, GitServerConfig
 # #region GitServiceSyncMixin [C:3] [TYPE Class]
 # @BRIEF Mixin providing push and pull operations with origin host alignment.
 class GitServiceSyncMixin:
-    # region push_changes [TYPE Function]
-    # @PURPOSE: Push local commits to remote.
+    # region push_changes [C:4] [TYPE Function] [SEMANTICS git,push,lock]
+    # @PURPOSE: Push local commits to remote (concurrent-safe).
     # @PRE: Repository exists and has an 'origin' remote.
     # @POST: Local branch commits are pushed to origin.
     def push_changes(self, dashboard_id: int):
-        with belief_scope("GitService.push_changes"):
-            repo = self.get_repo(dashboard_id)
+        with self._locked(dashboard_id):
+            with belief_scope("GitService.push_changes"):
+                repo = self.get_repo(dashboard_id)
             if not repo.heads:
                 logger.warning(f"[push_changes][Coherence:Failed] No local branches to push for dashboard {dashboard_id}")
                 return
@@ -110,13 +111,14 @@ class GitServiceSyncMixin:
                 raise HTTPException(status_code=500, detail=f"Git push failed: {e!s}")
     # endregion push_changes
 
-    # region pull_changes [TYPE Function]
-    # @PURPOSE: Pull changes from remote.
+    # region pull_changes [C:4] [TYPE Function] [SEMANTICS git,pull,lock]
+    # @PURPOSE: Pull changes from remote (concurrent-safe).
     # @PRE: Repository exists and has an 'origin' remote.
     # @POST: Changes from origin are pulled and merged into the active branch.
     def pull_changes(self, dashboard_id: int):
-        with belief_scope("GitService.pull_changes"):
-            repo = self.get_repo(dashboard_id)
+        with self._locked(dashboard_id):
+            with belief_scope("GitService.pull_changes"):
+                repo = self.get_repo(dashboard_id)
             merge_head_path = os.path.join(repo.git_dir, "MERGE_HEAD")
             if os.path.exists(merge_head_path):
                 payload = self._build_unfinished_merge_payload(repo)