Tighten ATVM git push approval gate

atvm/docs/automation/run-learnings.md

@@ -373,3 +373,13 @@ This file stores run-specific examples only when a run produced a new learning r
   - When grouped XML lacks explicit host testcase results, recover grouped host status from the per-host reporter JSON or equivalent detailed artifact.
   - Carry through the real `failures`, `pending`, and failure message from that host artifact instead of assuming `PASS completed`.
   - If a correction post is needed because stale or reconstructed state was wrong, mark it explicitly as a correction that supersedes the earlier result.
+
+## Run Learning: 2026-03-30 (Git push must stay manual even after commit approval)
+- Observed failure mode:
+  - After creating a requested local commit, the assistant treated a later `approve` as permission to run `git push`.
+  - The operator expectation was stricter: the assistant should stop at the local commit and only provide the manual push command reference.
+- Action for future runs:
+  - Treat commit creation and push as separate gates.
+  - Never execute `git push` for this workspace unless the operator explicitly overrides the workspace rule.
+  - After creating a local commit, provide the manual push command reference only, defaulting to `git push origin main` unless the operator explicitly asks for a different remote or branch.
+  - Do not interpret a generic `approve` after a commit as push approval.