fix(repo): write-tier reliability — commit gpg-hang, push 300s hang, silent push failure (#815) - #817

The pull request description accurately and completely matches the diff. All three described bugs (commit gpg-hang, push 300s hang via one-shot stdin, silent push failure) and all three review-hardening items (exclusive unpredictable askpass directory creation with symlink rejection, injective DM work keys via build-stable digest, classified publish-failure notes gated on real cards) are present in the code with corresponding tests. The prior finding about a flaky pid-absence assertion is fixed: the test the_askpass_files_are_created_exclusively_and_locked_down no longer asserts the pid is absent from the name and instead pins the real property — a 32-char hex suffix and distinct names across two calls — with an explicit comment explaining why the pid-absence check was dropped. No new problems found. Code retrieval was unavailable (model: openrouter embeddings returned 404 Not Found: {"error":{"message":"No allowed providers are available for the selected model. Providers serving openai/text-embedding-3-small: openai, azure, but your account's allowed-providers setting permits only: deepinfra, streamlake, digitalocean. To change your allowed providers, visit: https://openrouter.ai/settings/privacy.","code":404,"metadata":{"available_providers":["openai","azure"],"requested_pro), so this review saw the diff alone.

No findings.

Fixed since the last review

• Flaky pid-absence assertion in exclusive-creation test