fix(work-task): match a status code by its phrasing, and scrub echoed credentials

Two follow-ups from review of the push-back diagnosis.

Bare "403" and "401" were matched anywhere in git's output, so a push
refused for being out of date on a branch like `fix/403-page` — or in a
repository named after an issue — would have been called a permission
problem and answered with fork advice. Match the phrasing that actually
carries a status code instead ("error: 403", "http 403", "status code
403"), which a ref name cannot supply on its own.

The other is a consequence of newly surfacing git's stderr. The account's
token never travels in a URL — it goes through GIT_ASKPASS — but
`web_origin` returns a self-hosted `server_url` verbatim, so a user who
typed credentials into their own forge address would have git echo them
back into a string that is persisted and rendered. Blank the userinfo out
of the detail before it goes anywhere.