fix(opf): ship nothing on an explicit OPF cancel; report runtime failure first

Ctrl-C at the OPF prompt on git-refs now withholds the whole flush, already-trailered refs included, matching the documented contract that cancelled checkpoint refs stay queued. A decision that could not be resolved still ships refs that already carry the trailer.

When a broken OPF runtime stops the per-ref rewrite, it now outranks an earlier ref's cap error, so the user is pointed at the runtime rather than the cap.