Cover git update failure paths

[codeforester]

Summary

• Add git_update_repo tests for missing origin, unreachable origin, and non-fast-forward remote history.
• Make git_update_repo pull with --ff-only so divergent histories fail without mutating the local checkout.
• Strengthen the basectl update dirty-worktree test to prove the git update path is not loaded or called.

Validation

• bats lib/bash/git/tests/lib_git.bats
• bats cli/bash/commands/basectl/tests/update.bats
• bash -n lib/bash/git/lib_git.sh cli/bash/commands/basectl/tests/update.bats lib/bash/git/tests/lib_git.bats
• env -u BASE_HOME HOME=/private/tmp/base-review-home BASE_TEST_PYTHON=/Users/rameshhp/.base.d/base/.venv/bin/python bin/base-test
• git diff --check

Closes #333