rtk git push reports "ok (up-to-date)" when push is rejected by GitHub repository rulesets

Summary

rtk git push silently swallows GitHub repository ruleset rejections (GH013), reporting ok (up-to-date) instead of surfacing the error. This is the same bug class as #1535 (stash exit code swallowing) but for the push handler.

Steps to Reproduce

1. Configure a GitHub repository with branch rulesets requiring PRs (not legacy branch protection — the newer repository rulesets)
2. Commit locally on a protected branch (e.g. alpha)
3. Run git push origin alpha through rtk

Expected Behavior

FAILED: git push
remote: error: GH013: Repository rule violations found for refs/heads/alpha.
remote: - Changes must be made through a pull request.
! [remote rejected] alpha -> alpha (push declined due to repository rule violations)

Exit code: non-zero

Actual Behavior

ok (up-to-date)

Exit code: 0

Verification

Running rtk proxy git push origin <branch>:alpha (bypassing filtering) shows the actual rejection:

remote: error: GH013: Repository rule violations found for refs/heads/alpha.
remote: Review all repository rules at https://github.com/...
remote: 
remote: - Changes must be made through a pull request.
To https://github.com/...
 ! [remote rejected] ... -> alpha (push declined due to repository rule violations)
error: failed to push some refs to '...'

Exit code: 1

Analysis

The run_push handler at src/cmds/git/git.rs:972 checks output.status.success() and only prints the summarized "ok" output when exit code is 0. Two possible root causes:

1. Git transport exit code inconsistency: GitHub's newer repository rulesets (not legacy branch protection) may cause git push to return exit 0 even though the server rejects the push via the remote: error stream. The run_push handler trusts the exit code, sees Everything up-to-date in stderr (since no refs were actually transferred), and reports success.

2. Stderr pattern not checked: Even if exit code is 0, stderr contains remote: error:, ! [remote rejected], and GH013 — all clear failure signals that run_push should detect.

Suggested Fix

In addition to checking output.status.success(), the push handler should scan stderr for rejection patterns before reporting success:

• ! [remote rejected]
• remote: error:
• push declined
• GH013

If any of these appear, treat it as a failure regardless of exit code — print the full stderr and return non-zero.

This is the same pattern recommended in #1535 for the stash handler: don't trust exit code alone.

Impact

This is a high-severity bug for AI agent workflows. An agent pushing to a protected branch sees "ok" and proceeds as if the push succeeded. In our case, Claude Code committed workflow changes, "pushed" to alpha, and reported success to the user — the push never landed.

Environment

• rtk 0.37.2 (Homebrew, macOS ARM64)
• git 2.49.0
• GitHub repository rulesets (not legacy branch protection)