Report the gh error on a skipped apply, don't guess it

[gavinbee]

What & why

The first release rollout (run 34010517658) logged two gh: Upgrade to GitHub Pro or make this repository public to enable this feature. (HTTP 403) lines that read as unexplained failures. They were the expected private-repo branch-protection skips on officials-admin and rems-sync-apps-script, but nothing at the point of the message said so.

Two causes, one fix:

• Neither apply_branch_protection nor apply_ruleset captured stderr. gh's stderr is unbuffered while Python's stdout is block-buffered when piped, so the raw 403 reached the log ~9 seconds ahead of all the === repo === headers — detached from the SKIP line that explained it.
• gh_error had nothing to work with. The ruleset handler already called it, but with stderr uncaptured it could only ever fall back to (exit 1). That path hasn't fired yet, so it would have bitten the first time a ruleset apply failed.

Both now pass stderr=subprocess.PIPE, and the branch-protection skip reports what GitHub actually said instead of asserting the cause. A 403 from the token lacking Administration write is indistinguishable from here, and naming the plan limitation for it would send the reader down the wrong path:

SKIP branches.main: PUT failed: gh: Upgrade to GitHub Pro or make this repository
public to enable this feature. (HTTP 403). Merge-method settings above still
applied. The Pro/visibility 403 is the expected plan limit on a private repo;
any other error is not.

gh_error's docstring now states that capturing stderr is part of its contract, since that is the invariant both call sites broke.

Testing

• ruff check . clean.
• pytest -q — 34 passed, 2 new.
• The new TestStderrIsCaptured cases were checked against the unfixed script and fail there (KeyError: 'stderr'), so they are not passing vacuously.

Checklist

• Linked the issue this PR closes — n/a, no-issue
• Tests added/updated and passing
• ruff check . clean (Python repos)
• Docs/README updated if user-facing behaviour changed — n/a, log text only

NO-ISSUE: log clarity, cause found while verifying the first release rollout

🤖 Generated with Claude Code