fix(gitflow): every autopush reader fails closed and names an invalid value

Run D1 of manual-push mode (BDR-114). `git config --bool --default true
gitflow.autopush` only covered a MISSING key: an unparseable value made
git die with empty output, the `= false` test failed, and every push ran
again. A typo on a work machine silently re-enabled the pushes it was
meant to stop.

- lib/gitflow.sh: `_gitflow_push_off` reads the mode through the lib
  verb (`push-mode`); anything but `auto` is push-off, and the verb's
  stderr line names an invalid value during start/finish.
- Emitted post-commit/post-merge hooks (POSIX sh, standalone): push only
  when the key reads `true` or is unset; `false` exits quietly; any
  other result prints one stderr line ("NOT pushed, treated as manual
  push mode") and exits 0. Mirrors gitflow_push_mode.
- .githooks/ and githooks/ regenerated files-only through `emit-hook`
  (no config read or write; .git/config hash unchanged).
- hooks/unpushed-guard.sh: mode from the lib verb (absolute lib path
  resolved before any cd, no temp file); anything but auto is manual;
  the SessionStart line names an invalid or unreadable value.
- Tests: gitflow-test T18q block (invalid → start, hook and finish push
  nothing and say so; `true` → the hook pushes; emitted hook is
  POSIX-clean), unpushed-guard T14 rewritten.

githooks/post-merge

@@ -5,8 +5,15 @@ hook=post-merge
 # holds. Never fails the commit: no origin / offline / refused → warning only.
 # Opt out for one command with GITFLOW_NO_PUSH=1 (throwaway repos, tests).
 [ "${GITFLOW_NO_PUSH:-0}" = 1 ] && exit 0
-# Per-repo opt-out (no push rights on a foreign clone): git config gitflow.autopush false
-[ "$(git config --bool --default true gitflow.autopush)" = false ] && exit 0
+# Manual-push mode (human-set): git config gitflow.autopush false. Fail closed:
+# an unparseable value or a config read failure also means "no push", named.
+# Mirrors gitflow_push_mode (lib/gitflow.sh); arms pinned by T18b/T18h/T18q2/T18q4.
+v=$(git config --bool gitflow.autopush 2>/dev/null); rc=$?
+case "$rc:$v" in
+  0:true|1:*) ;;
+  0:false) exit 0 ;;
+  *) echo "gitflow $hook: gitflow.autopush unreadable (git rc $rc) — NOT pushed, treated as manual push mode; fix the value by hand" >&2; exit 0 ;;
+esac
 git remote get-url origin >/dev/null 2>&1 || exit 0
 br=$(git symbolic-ref --short -q HEAD 2>/dev/null) || exit 0   # detached HEAD — nothing to track
 if command -v timeout >/dev/null 2>&1; then t="timeout ${GITFLOW_PUSH_TIMEOUT:-30}"; else t=""; fi