fix(gitflow): run C polish — 5C coherence, sanitized verb stderr, hermetic suite

Closes the non-gap observations the gates left on runs C1/C2:

- capitalize STEP 5C/6: heading no longer says "+ push"; the --no-push
  fact read is its own paragraph and scoped to that path; the
  auto-persisted line requires finish rc 0 AND ahead = 0; rc 5/2/6
  (merged, branch not deleted) still report the push state; the
  "not on origin" line carries the once-a-remote-exists hint.
- gitflow.sh push-mode: the raw config value echoed on stderr is reduced
  to printable characters (LC_ALL=C, BSD tr safe) and capped at 64.
- gitflow-test.sh exports the hermetic git config env in the file, so a
  bare run on a global-manual machine stays green.
- client-handover-writer: the branch allowlist refuses a leading dash.

lib/gitflow-test.sh

@@ -6,6 +6,7 @@
 # (the chk helper EVALs its second arg; single-quoted assertion strings are
 #  intentional — they must not expand at definition time.)
 set -uo pipefail
+export GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_SYSTEM=/dev/null
 HERE="$(cd "$(dirname "$0")" && pwd)"
 # Do NOT override GITFLOW_GITIGNORE_TEMPLATE: the lib self-resolves it from its
 # own location (../templates), which is correct in both the repo and installed.

lib/gitflow.sh

@@ -81,7 +81,8 @@ gitflow_push_mode() {
   case "$rc:$val" in
     0:false)    echo manual ;;
     0:true|1:*) echo auto ;;
-    *) raw=$(git config gitflow.autopush 2>/dev/null)
+    *) raw=$(git config gitflow.autopush 2>/dev/null | LC_ALL=C tr -cd '[:print:]' 2>/dev/null)
+       raw=${raw:0:64}
        if [ -n "$raw" ]; then
          echo "gitflow.sh push-mode: gitflow.autopush='$raw'" \
               "is not a boolean (git rc $rc)" >&2