cli, seat, harness: git socket hardening and refusal tests, row 100 (#1594)

Row 93 follow-up: SIGTERM then SIGKILL for host git, rollback-failed,
a total body deadline, fetch-aborted for a reviewer gone mid-fetch,
working refs first in have, and tests for five untested refusals.
Dewey approved in 28226 and Sage in 28225; Sage's full gate passed
16:57:32-17:01:32Z. The host side is live at the next bus restart.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/cli/README.md

@@ -336,12 +336,31 @@ refuses, the ref goes back. A refusal is `{ok: false, error: <code>}` and
 ends the connection. The host's own refusals go through the broker's
 `refuse` with the task ref as subject, so each is an `action.refused`
 event on the task's trail. Eight connections are served at once; more
-refuse `git-busy`.
+refuse `git-busy`. A connection holds its slot until it ends, so a push's
+bundle has to come within a deadline: no gap over 30 s, and all of it
+within 30 s plus 1 s per 256 KB (`bodyDeadline`, 161 s at the 32 MiB cap).
+Past either it refuses `body-timeout`.
+
+Codes a reviewer may see that aren't the broker's:
+
+- `nothing-to-fetch`: the reviewer's clones already have the commit, by the
+  `have` list the runner sent, so there is no bundle to send. The commit is
+  already in one of its clones under `refs/remotes/`.
+- `unknown-project`: the review names a project this business no longer
+  has.
+- `fetch-aborted`: the reviewer's side closed the connection before the
+  whole bundle was sent. That is the reviewer's doing, not the host's, so
+  it isn't logged.
+
+`git-failed` (an error in the host that has no code of its own) and
+`rollback-failed` (a push the broker refused whose work ref couldn't go
+back) are the host's own faults, and the host logs them as well.
 
 A bundle file lives in `bus-host/` (0700) under a random name and is
-deleted on every path. On close the launcher drops the git socket's
-connections and waits for any push in flight to finish under its lock
-before the broker stops.
+deleted on every path. On close the launcher answers `host-closing` to a
+connection still sending its request line, since nothing of it ran yet,
+and drops every other connection. It waits for any push in flight to finish
+under its lock before the broker stops.
 
 ### Trackers