fix(gitflow): run C polish — 5C coherence, sanitized verb stderr, hermetic suite

Closes the non-gap observations the gates left on runs C1/C2:

- capitalize STEP 5C/6: heading no longer says "+ push"; the --no-push
  fact read is its own paragraph and scoped to that path; the
  auto-persisted line requires finish rc 0 AND ahead = 0; rc 5/2/6
  (merged, branch not deleted) still report the push state; the
  "not on origin" line carries the once-a-remote-exists hint.
- gitflow.sh push-mode: the raw config value echoed on stderr is reduced
  to printable characters (LC_ALL=C, BSD tr safe) and capped at 64.
- gitflow-test.sh exports the hermetic git config env in the file, so a
  bare run on a global-manual machine stays green.
- client-handover-writer: the branch allowlist refuses a leading dash.

agents/client-handover-writer.md

@@ -571,7 +571,7 @@ If `PENDING_CHANGES` non-empty → invoke /commit-change skill via subagent:
 `git branch --show-current` → `<br>`;
 `git remote get-url origin >/dev/null 2>&1 && echo origin || echo no-origin`;
 `git rev-list --count origin/<br>..<br> 2>/dev/null || echo unknown` →
-`ahead`. Validate `<br>` against `^[A-Za-z0-9._/-]+$` before using it
+`ahead`. Validate `<br>` against `^[A-Za-z0-9._/][A-Za-z0-9._/-]*$` before using it
 anywhere (git accepts shell metacharacters in branch names). On mismatch:
 state = `unknown (branch name contains characters this pipeline refuses to
 interpolate: push by hand after renaming the branch)`, interpolate NOTHING,