fix(agents-vault): surface commit-hook rejection as exit 1

_agents_repo_sync fell off the end of its final if-block when git commit
failed, e.g. a pre-commit or commit-msg hook rejecting it (this repo runs
ggshield and Git-LFS hooks). fish's if construct sets status 0 when the
condition is false and there is no else branch, so a rejected commit was
being reported as success rather than as the documented "not a git
repository" exit 1 it was assumed to fall through to.

Add an explicit else branch that emits a stderr diagnostic and returns 1,
and widen the EXIT STATUS/DESCRIPTION docs to cover this path under the
existing code 1 rather than adding a fourth code, since later tasks
already consume the 0/1/2 contract.

tests/test-agents-vault.fish

@@ -183,6 +183,25 @@ check "conflict commits nothing" $before_count (git -C $s rev-list --count HEAD)
 check "conflict content survives" ours (cat $s/a.md)
 check "conflict left no markers" false (grep -q '<<<<<<<' $s/a.md; and echo true; or echo false)
 
+# Commit-hook rejection: the commit call itself fails (e.g. a secret
+# scanner in a pre-commit hook), distinct from "not a git repository" --
+# both currently map to exit 1, so this must not fall through silently or
+# report success.
+set -l h (new_repo)
+echo first >$h/a.md
+_agents_repo_sync $h "chore: init" >/dev/null
+
+set -l hooks (mktemp -d); set -ga TMPDIRS $hooks
+printf '#!/bin/sh\nexit 1\n' >$hooks/pre-commit
+chmod +x $hooks/pre-commit
+git -C $h config core.hooksPath $hooks
+
+echo second >$h/a.md
+set -l before_hook_count (git -C $h rev-list --count HEAD)
+set -l hrc (_agents_repo_sync $h "chore: blocked" 2>/dev/null; echo $status)
+check "commit hook rejection returns 1" 1 "$hrc"
+check "commit hook rejection commits nothing" $before_hook_count (git -C $h rev-list --count HEAD)
+
 cleanup
 echo ""
 echo (math $TESTS_RUN - $TESTS_FAILED)"/$TESTS_RUN passed"