Fix git diff artifact export after alias authorization rejection

[baron]

Summary

• allow git diff artifact export to return successfully when advertised _git_data alias authorization is rejected
• invalidate advertised git artifact aliases after authorization failure so rejected aliases remain unselectable
• add a regression covering explicit linked-worktree diff artifacts without a tab binding, including the security postcondition that the returned alias cannot be selected

Root cause

The git tool published diff artifacts successfully, but then treated failure to authorize advertised _git_data aliases as a fatal tool error. That could surface as a worktree/provenance pathing failure even when the caller only needed the already-published artifact output.

Review

• Consulted Claude Fable 5 High; no must-fix findings.
• Addressed the suggested regression hardening by asserting the rejected alias cannot be added through manage_selection.

Validation

• make dev-format ✅
• make dev-test FILTER=MCPAskOracleWorktreeTests/testGitDiffArtifactsReturnWhenExplicitLinkedWorktreeAdvertisementIsUnauthorized ✅
• make dev-lint ✅
• .agents/skills/rpce-contribution-check/scripts/preflight.sh commit ✅
• .agents/skills/rpce-contribution-check/scripts/preflight.sh push ✅

PR-ready caveat

• .agents/skills/rpce-contribution-check/scripts/preflight.sh pr-ready was attempted.
• The safety/lint portions passed, then the full root make dev-test lane produced broad unrelated CodeMap/Codemap projection failures outside this diff. I canceled the already-failing root test job to avoid holding the build lane further.
• Focused regression and lint are green for this change.