fix: restore rejected staged note entries

[johnson-ricon]

Summary

• snapshot a tracked readable note's exact index entry before renormalization
• restore that entry whenever ciphertext post-verification refuses the staged result
• cover the rejected-plaintext path with an index-preservation regression

Why

PR #197 verifies tracked-note ciphertext only after git add --renormalize. When that check rejected a plaintext-producing filter, the failed command left the plaintext replacement staged. A subsequent ordinary commit could auto-obfuscate and commit that changed plaintext under an opaque ID because the staged attributes no longer selected Git Crypt.

This focused fix makes the failed stage operation restore the entry it replaced.

Validation

• focused rollback regression: pass
• mise run test stage: 29/29 passed
• complete repository suite: 466 BATS cases (460 passed, 6 existing environment skips) and 9/9 Python passed
• real disposable failure/commit pilot: the refused note entry returned to its original blob and the following commit contained only the separately staged attributes
• Bash syntax and git diff --check

Fix-it for #197. Targets junior/onboard-existing-plaintext; does not merge or release.