wireprotocol: use visibleheads as reference while unbundling (issue 3303) The `repo` object here is *always* local. Using `repo.heads()` ensure we will reject push if any secret changeset exists. During discovery, `visibleheads` were sent to the peer. So we can only expect it to send us `visibleheads` back. If any secret changeset exists:: visibleheads != repo.heads() This fix server side part of issue 3303 when pushing over the wire.