job4: SPEC-12 deploy-commit exit taxonomy

lib/deploy-commit.sh: a rejected `git commit` (pre-commit hook,
protected branch, signing failure) now exits 6 (loud stderr, distinct
from rc 1's "nothing to do") instead of sharing rc 1 with the no-op
cases. Header comment documents the full 0/1/2/3/4/5/6 taxonomy.
Closes J4-22 (UNTESTABLE): at client repos, a failed deploy-state
commit was indistinguishable BY EXIT CODE from "nothing to do" (rc 1
was shared 3 ways); exit-code-only callers couldn't disambiguate
(stderr-parsing callers already could).

Caller census (per report's explicit gate): skills/deploy/SKILL.md
documents and parses this exit-code contract in TWO places (bootstrap
commit + incident-recovery commit). Flagged to the user before
committing; confirmed GO to add rc 6 there too (additive — no existing
code's meaning changes) so the documented contract stays accurate for
live deploy runs.

New T10 in lib/tests/deploy-commit.test.sh (+3 assertions, 13→16):
rejecting pre-commit hook sandbox — asserts rc 6, empty stdout (no
stale hash), HEAD unmoved.

GREEN: full `make test` exit 0 (deploy-commit 16/16 incl. T10).
shellcheck clean, bash -n clean.

lib/tests/deploy-commit.test.sh

@@ -50,4 +50,13 @@ printf 'run\n' >"$d/.claude/deploy/PROCEDURE.md"
 ( cd "$d" && bash "$H" commit "docs(deploy): t" .claude/deploy/PROCEDURE.md ) >/dev/null 2>&1
 check T9-ignored-rc "$?" 5
 
+d=$(mkrepo); printf '#!/bin/sh\nexit 1\n' >"$d/.git/hooks/pre-commit"; chmod +x "$d/.git/hooks/pre-commit"
+BEFORE=$(git -C "$d" rev-parse --short HEAD)
+printf 'run\n' >"$d/.claude/deploy/PROCEDURE.md"
+OUT=$( ( cd "$d" && bash "$H" commit "docs(deploy): t" .claude/deploy/PROCEDURE.md ) 2>/dev/null ); RC=$?
+AFTER=$(git -C "$d" rev-parse --short HEAD)
+check T10-rejected-rc "$RC" 6
+check T10-rejected-no-hash "$([ -z "$OUT" ] && echo empty || echo "$OUT")" empty
+check T10-rejected-head-unmoved "$BEFORE" "$AFTER"
+
 printf 'PASS=%s FAIL=%s\n' "$pass" "$fail"; [ "$fail" -eq 0 ]