Hard restore with X asks before dropping staged pins

X dropped staged pins without a question, including the selected
submodule's own pin, which the loss check didn't count. A staged pin is
a decision, and X sits one Shift away from x, so dropped staged pins now
count as a loss and make X ask (D31, amends D30).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/submodule/git/restore_test.go

@@ -364,6 +364,29 @@ func TestRestoreHardOfASubmoduleUnstagesItsPin(t *testing.T) {
 	}
 }
 
+func TestRestoreLossOfAHardRestoreCountsTheOwnStagedPin(t *testing.T) {
+	p, _ := ownFixture(t)
+	committed, err := p.RestoreLoss(context.Background(), "libs/staged", submodule.RestoreCommitted)
+	if err != nil {
+		t.Fatal(err)
+	}
+	hard, err := p.RestoreLoss(context.Background(), "libs/staged", submodule.RestoreHard)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if hard.StagedPins != committed.StagedPins+1 || hard.Modules == 0 {
+		t.Errorf("hard loss %+v, want the own staged pin on top of %+v", hard, committed)
+	}
+	// without a staged pin, a hard restore unstages nothing of its own
+	clean, err := p.RestoreLoss(context.Background(), "src/ui", submodule.RestoreHard)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if clean.StagedPins != 0 {
+		t.Errorf("loss of src/ui %+v, want no staged pin", clean)
+	}
+}
+
 func TestRestoreLossCountsStagedPinsOfAMovingRepository(t *testing.T) {
 	p, root := ownFixture(t)
 	super := filepath.Join(root, "super")