refactor(error): introduce CommandError typed leaf for buffered git failures

[max-sixty]

Summary

Builds on #2567 by replacing the leaf bail at the buffered command boundary with a typed error.

Repository::run_command and WorkingTree::run_command now return Err(CommandError { program, args, stderr, stdout, exit_code }) instead of bail!(\"{stderr}\"). The structured form lets the renderer separate a single-line summary (Display) from the multi-line captured payload (combined_output()), and lets callers that embed raw stderr in higher-level errors (RebaseConflict, WorktreeRemovalFailed, PushFailed, list-task errors) read it directly instead of round-tripping through e.to_string().

The debug_assert! that triggered #2564 in debug builds is now a meaningful invariant: it flags only multi-line bails that aren't typed as CommandError, instead of acting as a proxy for "developer remembered .context(...)."

What's in the diff

• worktrunk::git::CommandError (new) — typed leaf with combined_output() and a single-line Display.
• worktrunk::git::find_command_error / display_message — chain walkers for renderers and embedders.
• print_command_error refactored to format_command_error -> String (testable) with a downcast branch that preserves intermediate .context(...) entries above the captured body.
• Repository::extract_failed_command extended to recognize CommandError alongside StreamCommandError.
• 5 user-facing serialization sites migrated to display_message so wrappers like WorktreeRemovalFailed.error and PushFailed.error keep showing git's real stderr (rather than the new single-line summary).

Reviewer orientation

• src/git/error.rs — CommandError, find_command_error, display_message.
• src/git/repository/mod.rs, src/git/repository/working_tree.rs — leaf cutover.
• src/main.rs — renderer; the new branch and the trim-then-anstream print_command_error were both flagged in iteration.
• src/commands/{step_commands,worktree/push,list/collect/{mod,tasks}}.rs, src/output/handlers.rs — call-site migrations.

Notes

• .context(...) calls added in fix(prune): wrap multi-line git errors with context to silence debug_assert #2567 are no longer load-bearing for correctness — they remain as semantic UX. Pruning the mechanical ones is a follow-up.
• Method is combined_output() rather than output() because the no-direct-cmd-output pre-commit hook regex flags .output() to keep callers off std::process::Command::output.

Test plan

• cargo run -- hook pre-merge --yes — 3480 tests pass, all lints, all docs
• Codex iteration: P2 (preserve raw stderr in typed wrappers) and P3 (preserve context chain in renderer) addressed; tests added for both
• CI: linux/macos/windows test jobs green

This was written by Claude Code on behalf of @max-sixty

[worktrunk-bot]

One missed migration site: handle_detached_removed_worktree_output in src/output/handlers.rs:1268 still does error: err.to_string() for GitError::WorktreeRemovalFailed, while the named-removal sibling at line 1344 was updated to display_message(&err). Both call remove_worktree_with_cleanup, which now produces a CommandError-bearing error via Repository::remove_worktree / delete_branch_if_safe — so for detached-HEAD removals the user now sees "git worktree remove --force /path failed (exit 128)" instead of git's actual stderr. The docstring on display_message even names WorktreeRemovalFailed as the canonical case for this helper.

Happy to push a one-line fix if you'd like.