Preserve restore diagnostics through checkout wrappers

Nested saved-commit failures lost their closed diagnostic in checkout preparation and contents restoration. Preserve the normalized failure around publication hooks and retain its inner step. Keep process codes and timeout flags privately for classification without attaching raw command causes or changing generic error properties.

Recognize local Git file errors before authenticated transport messages. A numeric Git exit caused by FETCH_HEAD or local configuration permissions now reports filesystem rather than rejected credentials.

Real Git/Postgres regressions reproduce the lost nested commit and clone-timeout diagnostics before the fix. All seven affected suites pass (288 tests), including full expiration coverage for the controlled clone-failure seam. Layered server typechecking passes on supported Node 25.6.1. Whitespace and secrets/PII scans pass.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

doc/DEVELOPING.md

@@ -4539,6 +4539,10 @@ pair. Both are closed values: `step` names the failed stage (for example
 failure class (`remote_unavailable`, `auth_rejected`, `commit_unavailable`,
 `timeout`, `verification`, `filesystem`, `git_command` or `unknown`). They never
 contain paths, repository URLs or Git output.
+Nested checkout failures retain their original restore step. The checkout
+wrapper keeps process error codes and timeout flags privately for classification;
+it does not attach the raw command error as a cause or add those flags to the
+public error object.
 
 Both enable switches default off. Rollback disables further expiration while
 leaving saved recipes and restoration support intact. Recovery archives, runner