feat: add --fresh and name why a keyed pin waits

Branch tips, tags and releases are cached for six hours, and the
EKA2L1, trzy/Supermodel and VICE heads read as behind their real HEAD.
--fresh asks the forges again, and is refused with --offline.

A recale on a profile whose pins are keyed by build mode said the prose
had to move first. It now says the pins are set by hand.

tests/test_profile_sync.py

@@ -4599,6 +4599,18 @@ class TestRateLimitEndsOneProfile(unittest.TestCase):
         self.assertEqual(by_name["after"]["needs_review"], 1)
 
 
+class FreshRefusesOffline(unittest.TestCase):
+    def test_the_pair_is_refused(self):
+        saved = sys.argv
+        try:
+            sys.argv = ["profile_sync.py", "--all", "--fresh", "--offline"]
+            with contextlib.redirect_stderr(io.StringIO()), self.assertRaises(SystemExit) as caught:
+                profile_sync.main()
+        finally:
+            sys.argv = saved
+        self.assertEqual(caught.exception.code, 1)
+
+
 class TestOutputModesApplyTheirFlags(unittest.TestCase):
     """--changed-only narrows --json too. Extras are refused off the text report."""