oven: broaden pre-rebase cleanup to repo-wide checkout
The previous fix only cleaned papers/ before rebase, but the
papers-git-poller rewrites .last-papers-built-hash at the repo root
every cycle, leaving that file dirty and still blocking the rebase.
Switch from \`git checkout -- papers/\` to \`git checkout -- .\` so the
cleanup covers the whole working tree. We've already committed the PDFs
we care about at this point; everything else left unstaged is either
LaTeX build artifacts or poller state.