git-remote-entire: relay helper-status before send-pack exit check

send-pack exits non-zero on per-ref rejections (D/F conflict, protected
branch, server hook decline). The buffered `error refs/X <reason>` lines
are what git's transport-helper.c reads to render the user-visible
`! [remote rejected]` output. Forwarding helper-status only on the happy
path meant Wait/feed errors swallowed those lines, leaving users with
only `send-pack exited with error: exit status 1`.

Relay helper-status before checking exit codes so the real reason
reaches the user. Examples now surfaced:

  Branch protection violation
   ! [remote rejected]     branch-test -> branch-test (upstream: push declined due to repository rule violations)
  error: failed to push some refs to 'X'

  Invalid ref:
   ! [remote rejected]     test-prefix -> test-prefix (ref name conflicts with an existing ref namespace)
  error: failed to push some refs to 'X'

  Permissions:
   ! [remote rejected]   new-test/repo -> new-test/repo (pushing to GitHub: tracing transport: handshake: http transport: authorization failed: unexpected requesting "https://github.com/x/x/info/refs?service=git-receive-pack" status code: 403: Permission to x/x.git denied to <user>.)
  error: failed to push some refs to 'X'

Assisted-by: Claude Opus 4.7 <noreply@anthropic.com>
Signed-off-by: Paulo Gomes <paulo@entire.io>
Entire-Checkpoint: 25d3ab26f571

Author: pjbgf

internal/remotehelper/githelper/push.go

@@ -151,6 +151,20 @@ func handlePush(ctx context.Context, t Transport, firstLine string, opts *Option
 		return fmt.Errorf("reading helper-status: %w", err)
 	}
 
+	// Relay helper-status before checking exit codes. send-pack exits
+	// non-zero on per-ref rejections (D/F conflict, protected branch,
+	// hook decline); the buffered `error refs/X <reason>` lines are
+	// what git's transport-helper.c reads to print `! [remote rejected]
+	// refs/X (<reason>)`. Returning early on Wait/feed errors swallowed
+	// them, leaving users with only `send-pack exited with error: exit
+	// status 1`.
+	if _, err := stdout.Write(helperStatus); err != nil {
+		return fmt.Errorf("writing helper-status: %w", err)
+	}
+	if _, err := fmt.Fprintln(stdout); err != nil {
+		return fmt.Errorf("writing push terminator: %w", err)
+	}
+
 	if err := <-feedErr; err != nil {
 		if waitErr := sp.Wait(); waitErr != nil {
 			return errors.Join(err, fmt.Errorf("send-pack exited after feeder error: %w", waitErr))
@@ -160,13 +174,6 @@ func handlePush(ctx context.Context, t Transport, firstLine string, opts *Option
 	if err := sp.Wait(); err != nil {
 		return fmt.Errorf("send-pack exited with error: %w", err)
 	}
-
-	if _, err := stdout.Write(helperStatus); err != nil {
-		return fmt.Errorf("writing helper-status: %w", err)
-	}
-	if _, err := fmt.Fprintln(stdout); err != nil {
-		return fmt.Errorf("writing push terminator: %w", err)
-	}
 	return nil
 }