feat(gitflow): push-mode verb; /close reports the push state instead of pushing

Run C1 of manual-push mode (BDR-111/BDR-112).

- lib/gitflow.sh: `gitflow.sh push-mode` prints auto | manual | invalid
  (rc 0; an invalid value is named on stderr). It is the one reader a
  skill may call: the bare `git config … gitflow.*` read is denied to
  Claude since run B. Ignores GITFLOW_NO_PUSH by design (documented).
- skills/capitalize/SKILL.md STEP 5C: the explicit `git push origin
  develop` is gone — `finish` has pushed develop itself since BDR-095,
  mode-aware since run A. 5C is now three separate read-only calls
  (finish; push-mode; `git rev-list --count origin/develop..develop`)
  and prose outcomes keyed on the real ahead count: pushed / manual push
  mode, you push / not on origin / push FAILED / invalid value named,
  plus a finish-failure outcome (merge vs delete rc distinguished).
  STEP 6 closing lines and the recap carry every outcome; the
  `--no-push` line reads the branch's own ahead count ("this disk only"
  only when true). Invariant: no `git push` inside any Bash call; the
  user hints are prose.
- skills/close/SKILL.md, lib/gitflow-aiguillage.md: "push" claims
  qualified "in auto-push mode".
- lib/gitflow-test.sh T11b: six cases for the verb (default, true,
  false, non-boolean with stderr + rc 0, corrupt config, usage).

Polish items from the gates are listed in TODO.md (C1 polish).

lib/gitflow.sh

@@ -68,6 +68,32 @@ gitflow_release_open() {
   [ -n "$(git for-each-ref --format='%(refname:short)' 'refs/heads/release/*')" ]
 }
 
+# gitflow_push_mode -> stdout auto | manual | invalid, rc 0 always. The ONE
+# reader skills may call: `git config ... gitflow.*` is statically denied to
+# Claude (BDR-112). manual = key reads false; auto = true or unset; invalid =
+# anything else (unparseable value, git failure); the raw value goes to
+# stderr so the caller can name it. Reads only. Ignores GITFLOW_NO_PUSH (a
+# test-repo switch, not a mode): a caller that pushes must not rely on this
+# verb alone, the lib's own push sites use _gitflow_push_off.
+gitflow_push_mode() {
+  local val rc raw
+  val=$(git config --bool gitflow.autopush 2>/dev/null); rc=$?
+  case "$rc:$val" in
+    0:false)    echo manual ;;
+    0:true|1:*) echo auto ;;
+    *) raw=$(git config gitflow.autopush 2>/dev/null)
+       if [ -n "$raw" ]; then
+         echo "gitflow.sh push-mode: gitflow.autopush='$raw'" \
+              "is not a boolean (git rc $rc)" >&2
+       else
+         echo "gitflow.sh push-mode: could not read" \
+              "gitflow.autopush (git rc $rc)" >&2
+       fi
+       echo invalid ;;
+  esac
+  return 0
+}
+
 # ── start ────────────────────────────────────────────────────────────────────
 
 # rc 0 when pushing is off: GITFLOW_NO_PUSH=1 (throwaway test repos) or
@@ -597,6 +623,7 @@ if [ "${BASH_SOURCE[0]}" = "${0}" ]; then
     delete)         gitflow_delete "$@" ;;
     merged)         [ -n "${1:-}" ] || { echo "usage: gitflow.sh merged <branch>" >&2; exit 2; }
                     gitflow_merged_into_base "$1" ;;
+    push-mode)      gitflow_push_mode ;;
     hooks)          printf '%s\n' "${GITFLOW_HOOKS[@]}" ;;
     init)           gitflow_init "$@" ;;
     reconcile)      gitflow_reconcile_gitignore "$@" ;;
@@ -606,6 +633,6 @@ if [ "${BASH_SOURCE[0]}" = "${0}" ]; then
     global-hooks)   gitflow_global_hooks "$@" ;;
     emit-hook)      _gitflow_emit_hook "${1:-pre-commit}" \
                       || { echo "gitflow.sh emit-hook {$(IFS='|'; echo "${GITFLOW_HOOKS[*]}")}" >&2; exit 2; } ;;
-    *) echo "usage: gitflow.sh {type|protected-base|base-for|release-open|start|finish|delete <br>|merged <br>|init|reconcile|purge-transient|install-hook|reconcile-hooks|global-hooks <dir> [value]|hooks|emit-hook <name>}" >&2; exit 2 ;;
+    *) echo "usage: gitflow.sh {type|protected-base|base-for|release-open|start|finish|delete <br>|merged <br>|push-mode|init|reconcile|purge-transient|install-hook|reconcile-hooks|global-hooks <dir> [value]|hooks|emit-hook <name>}" >&2; exit 2 ;;
   esac
 fi