refactor(errors): route git-plumbing failure bails through CommandError

[max-sixty]

Follow-up to #3459. Eight git-plumbing sites turned a captured non-zero exit into bail!("…{stderr}"), bypassing CommandError::from_failed_output — the one constructor that normalizes \r and gives renderers the typed command/output split. This converts them (resolve_git_common_dir, the bulk config --list read, config --unset, config --get-regexp, merge-tree, merge-base, the untracked-diff numstat, and llm.rs::run_git_capture), so failed-command display routes through one constructor and the main.rs multiline-error tripwire has nothing left to catch on these paths. from_failed_output now takes &[impl AsRef<str>] so Vec<String> arg lists work.

One structural fix rode along: generate_commit_message now wraps only the execute_llm_command failure in GitError::LlmCommandFailed, mirroring generate_squash_message — a git failure while building the prompt is not an LLM-command failure, and flattening it into LlmCommandFailed.error dropped the typed stderr.

Rendering: context-wrapped failures render byte-identically (the outside-repo snapshots pass untouched); bare ones gain the standard git … failed (exit N) header + gutter. The only snapshot changes are two wt list task-failure lines where merge-base errors drop the hand-rolled git merge-base failed for <sha> <sha>: prefix and now match their sibling lines.

Every converted error path has a direct test — five new ones using empirically-probed failure modes (invalid regexp pattern → exit 6, invalid key → exit 1, corrupt config → 128 for the lazily-populated bulk read and merge-tree, unborn HEAD for the numstat), plus the updated run_git_capture unit test; resolve_git_common_dir and merge_base were already covered by existing snapshots.

Two same-pattern sites remain in the commands layer (step/shared.rs ls-files, step/commit.rs stage-to-temp-index) — deliberately left for a follow-up along with the non-git CLIs (gh/glab, claude/codex).

This was written by Claude Code on behalf of max

[worktrunk-bot]

Correct, behavior-preserving refactor — every converted path now routes failed-command display through the single from_failed_output constructor, and the direct-test coverage on each is thorough. One optional micro-nit inline; nothing blocking.