Test depth: cover force-push-with-lease rejection path in finalize_translations_local

[whisper67265]

Problem

finalize_translations_local uses git push --force-with-lease when force-pushing translation branches, but the rejection path—when the remote advances concurrently—was untested. Without coverage, regressions in error reporting, fail-fast behavior, or unsupported-Git handling could slip through unnoticed.

Acceptance Criteria

• When a concurrent push advances the remote before --force-with-lease, finalize_translations_local exits non-zero and stderr names the branch, remote HEAD SHA, and "force-with-lease push rejected"
• On lease rejection, the workflow does not retry (exactly one git fetch before push) and leaves the working tree clean with no stale index lock
• When Git lacks --force-with-lease support, commit_and_push_translations_branch fails fast with a clear message to upgrade to Git 2.8+

Implementation Notes

• git_push_supports_force_with_lease probes git push -h before attempting a force push; rejection after push captures remote_sha via ls-remote for actionable stderr
• Test helpers in git_fixtures.bash simulate concurrent writers (install_git_push_pre_hook, install_git_fetch_counter) and pre-2.8 Git (install_git_without_force_with_lease) via PATH-wrapped git binaries

References

• .github/workflows/assets/lib.sh
• tests/helpers/git_fixtures.bash
• tests/test_lib.bats