fix(forge): bound the git detail a delivery failure carries

Surfacing git's stderr made the failure legible, but it also put another
program's output into a string that is persisted on the task row and
rendered in the UI. A push refused by a server-side hook can answer with a
banner, and all of it would have been stored.

Keep a prefix — git leads with the line that identifies the failure and
follows with hints — and cut on a character boundary, since branch names
and hook banners arrive in any encoding and slicing mid-codepoint would
panic on the failure path itself.