ci: surface git's real rejection in version-at-land single-writer

[shipyard-local]

Why

The Model-B single-writer (version_at_land.py --push) ran git push via _git(capture_output=True, check=False) and, on failure, printed only its generic summary: version-at-land: exhausted retries without a fast-forward push; the branch kept moving. Re-run. git's actual stderr was captured and discarded.

That made a non-race rejection indistinguishable from a genuine fast-forward race. Concretely, this masked a release outage: main's main-merge-queue ruleset (Require merge queue) rejects the bot's direct git push origin HEAD:main with GH006: Changes must be made through the merge queue, even with an always-mode Repository-admin bypass in place — but every run just said "the branch kept moving," so it read as transient contention for hours.

What

Echo the porcelain rejection (exit code + git's own message) on each failed push attempt. No control-flow change — the retry loop still treats every failure as a lost race; this only makes the cause visible in the run log.

Test

Adds test_push_rejection_detail_is_surfaced: forces a losing (non-ff) push and asserts git's rejection text reaches stderr. Full test_version_at_land.py suite green locally (16 tests).

Scope

Observability only. The release outage itself is a design conflict (direct-push single-writer vs. required merge queue), tracked separately; this PR ends the "flying blind" gap flagged during that investigation.

🤖 Generated with Claude Code

---

🔎 Provenance

Agent	claude
Machine	m5
Tab	Set up fleet v2 project with Orchestrate in new workspace
Directory	~/Code/pulp-obsfix
Session	3239e1c5-c3ff-434a-ac47-7db21d930bce

Resume

claude --resume 3239e1c5-c3ff-434a-ac47-7db21d930bce

Jump to this tab

cmux surface focus 82BDD5A8-F7FA-441D-8D9D-B5763DF6E7FC

Relaunch (any agent)

cmux surface resume get --surface 82BDD5A8-F7FA-441D-8D9D-B5763DF6E7FC

Restore URL — https://claude.ai/code/session_017CdzQZrrtCETcDYH9MABhR

_{stamped 2026-07-20 15:44 UTC}