CLI-117: pr land --update-branch leaves a stale red check to a manual update #2497

Problem

dotf pr land <N> --update-branch updates a PR only when BEHIND is its only failing condition (prland.go, onlyBehind). On 2026-10-14 #2491 was red on from-zero (macos-latest) from BUG-138, which #2495 had just fixed on main. pr land 2491 --wait --update-branch answered [NOT MERGED] from-zero (macos-latest): fail; merge state is UNKNOWN and left the branch as it was. Landing it took a manual gh pr update-branch 2491, then a second pr land. CI went green on the updated head.

That manual step goes against the rule that every repeatable step is a dotf behaviour. The refusal does not say that the failing check ran on a head older than the base, or what to do about it.

Options (a decision, so it may need a spec)

1. With --update-branch, when the PR is behind and some checks are red, update once and decide again on the new head's checks. The maxUpdates bound still applies, and a check that stays red still refuses.
2. Keep the rule, and have the refusal name the case: "behind main and red: gh pr update-branch N reruns CI on the current base".

Option 1 spends one CI run on a PR that is red for its own reasons. Option 2 keeps the manual step.

Evidence

• The refactor(converge): render the goldens through the production printer and probe the terminal once #2491 landing output above. gh pr update-branch 2491, then [MERGED] #2491 at 3029996.