repo: properly progate "destroyed" call to super class
The propagation of the 'destroyed' call was dropped. I'm not certain of the
consequences of having a partially broken "destroyed" call, but this can't be
good.
safeguard: add an option to disable automatic publishing
Pushing to publishing server by mistake is a bit too common in the current state
of evolve. Especially when the lack of good feature branch story make the use of
-f a bit too common.
So we add a very simple experimental option to allow warning (or abort) when
changeset are pushed to a publishing server. This is unlikely to survive as is,
but this is useful now.