pull: ensure that all commits are at least draft

This is an old bug, reported years ago on Bitbucket. Previously, setting phases.new-commit to secret would trigger an error in clone:

abort: filtered revision '7fe02317c63d9ee324d4b5df7c9296085162da1b'

I'm not entirely sure why that happens, I didn't delve too deeply. Essentially, pulls from hg-git should be draft, so I fixed that instead. The secret phase is for stuff neither to push to Mercurial nor Git; it does not distinguish commits based on their origin.

The bug report dates from several years ago; so long ago that one might reasonably debate whether this is a bug fix or an enhancement. Since fixing old code is significantly easier on default, that's where I've put this change.

Fixes #266 (closed).