fix: submit an explicitly-named bookmark regardless of author (RIG-2267)

[rigel-mintaka]

This PR is part of a stack containing 2 PRs:

1. main
2. test(config): make non-UTF-8 token fixture portable (octal, not hex printf) #1
3. "fix: submit an explicitly-named bookmark regardless of author (RIG-2267)" (this PR)

jj-vine submit <bookmark> silently no-ops — exit 0, "No bookmarks pushed" — when the bookmark's commit author differs from the configured jj user.email. The fleet's commit-author flip (seal@sealedsecurity.com → mintaka@rigel.build) left pre-flip commits authored under the old identity, so re-submitting one of those bookmarks quietly does nothing.

Root cause is a two-pass double-filter. submit() resolves the bookmark set from the revset (pass 1, verbatim), announces it, then re-resolves what to actually submit via find_changes_to_submit (pass 2). Pass 2 intersected the explicitly-named target with mine(), so a foreign-authored named bookmark resolved to the empty set — announced, then dropped, with a success exit.

Fix (both halves):

• find_changes_to_submit (src/submit.rs) — include an explicitly-named target raw; only the ancestry-walked companions stay narrowed by mine() (so a stacked submit still doesn't sweep in other people's bookmarks). Revset becomes (({explicit}) | (({ancestry}) & mine() & bookmarks()) | ({pending})) ~ (::trunk()).
• submit() guard (src/commands/submit.rs) — after pass 2, if pass 1 announced a non-empty bookmark set but pass 2 resolved nothing, fail loudly with an actionable message instead of exiting 0. The guard runs before ForgeImpl::new, so it fails before any token subprocess or HTTP-client construction. Guard error renders bookmark names via raw_name(), not the colorizing Display (no ANSI leaking into the propagated error string).

Three red-green kill-tests: find_changes_to_submit_includes_foreign_authored_named_target (Option A — a bookmark authored under a different identity is still found), find_changes_to_submit_excludes_foreign_authored_ancestry_companion (the & mine() narrowing still excludes a foreign-authored ancestry companion from a stacked submit), and named_bookmark_in_trunk_errors_instead_of_silent_noop (Option B — the guard fires). Each fails on the pre-fix code and passes after.

This fix originated in the orion oss/forks/jj-vine/ subtree (RIG-2267) and moved here when the fork externalized to its own repo.

CI / stack note. This PR is stacked on #1 (fix-non-utf8-token-test-portability), which repairs a pre-existing seed bug — config::tests::resolved_token_errors_on_non_utf8_output used a printf '\xff\xfe' fixture that only emits non-UTF-8 bytes under bash, not the dash /bin/sh on GitHub's ubuntu runners. The fork's main has been red since the seed commit; #1 is what turns Test green, so this PR stacks on it and its own three kill-tests run green there. The Build - * matrix reds on a second, independent seed bug (ci.yml used github.ref_name = refs/pull/N/merge as the artifact VERSION, so cp targets a nonexistent .../N/merge dir) — fixed separately by #3 (guard-build-matrix-to-dispatch) and non-blocking here (fork main has no required checks; the release matrix is dead weight on push/PR triggers). Neither red is introduced by this change.

Spec-impact: none.

Closes RIG-2267

Co-authored-by: Matt Wilkinson matt@rigel.build

[linear-code]

RIG-2267