fix: network property means any network reach, not only HTTP (#144)

Files changed:
- CHANGES.md
- VERSION
- tools/CONTRACT.md
- tools/chemenu/cli_contract.py
- tools/chemenu/commands/git_publish.py
- tools/chemenu/commands/upstream_cmd.py
- tools/chemenu/commands/version_cmd.py
- tools/chemenu/tests/test_cli.py
- tools/chemenu/version.py

tools/CONTRACT.md

@@ -1611,7 +1611,7 @@ Fetch `<remote>/<branch>` and bring the local branch up to date with it.
 - idempotent: yes
 - atomic: No - fetch, then at most one merge/rebase attempt, aborted cleanly on failure
 - budget: counted
-- network: no
+- network: yes
 - gates: rebase-review
 
 **EXAMPLES**
@@ -1664,7 +1664,7 @@ Reconcile with `<remote>/<branch>`, then stage all changes, commit, and push.
 - idempotent: no
 - atomic: No - sequential git operations, but every gate runs before staging
 - budget: counted
-- network: no
+- network: yes
 - gates: mass-update, publish-remote, rebase-review
 
 **EXAMPLES**
@@ -2566,7 +2566,7 @@ Ask the origin's release feed whether a newer stack exists.
 **NOTES**
 
 - Asks the release feed for its latest release and compares it with `VERSION`: `state` is `current`, `update`, `migration` (the step crosses a compatibility boundary) or `ahead`.
-- One of the **two** commands in `wikitool` that make a network call, and the only one whose whole job it is - `version notes` is the other, and only on a distributed instance.
+- The only command whose whole job is the network call - `version notes` reaches the same feed too, but only as a fallback on a distributed instance.
 - Never reached implicitly from another command, needs no key, and times out after `--timeout` seconds (default 10).
 - The feed is `--url`, else `$WIKITOOL_UPDATE_URL`, else the release stamp's, else the built-in origin. `$WIKITOOL_UPDATE_TOKEN` is only needed if that feed is not readable anonymously.
 - For `update` or `migration` it prints that applying the release is a separate, manual step (`INSTALL.md` § "Eine Instanz aktualisieren").
@@ -3042,7 +3042,7 @@ Take a stack update into a private instance's branch, machinery only.
 - idempotent: no
 - atomic: **No** - can leave an open, uncommitted merge behind on refusal after fetching
 - budget: counted
-- network: no
+- network: yes
 
 **EXAMPLES**