fix: fail safely when AUR synchronization fails

README.md

@@ -85,12 +85,15 @@ its `sha256sums` entry is regenerated first. A README-only edit does not.
 | `NO_GIT_PUSH=1` | dry run: do everything except push |
 | `FORCE_REBUILD=1` | bump `pkgrel` even with no detected change |
 | `FORCE_REFRESH=1` | re-download remote sources without a version change |
-| `AUR_FORCE=1` | force-push over diverged AUR history (see below) |
 | `GIT_HOST` | git host holding the package repos |
 | `GITHUB_TOKEN` | optional; avoids GitHub's 60/hour anonymous rate limit |
 
-A rejected AUR push usually means someone pushed there directly. The run fails
-loudly rather than overwriting it; inspect, then re-run with `AUR_FORCE=1`.
+There is deliberately no force-push escape hatch. The AUR accepts fast-forwards
+only and refuses force pushes from anyone who is not an AUR administrator, so
+such a flag could never do anything except recommend a remedy that always fails.
+`sync-aur.sh` checks fast-forward status *before* pushing and, on failure, prints
+git's actual error and names a cause that fits it — a rejected SSH key, an
+unreachable host, or a genuine divergence — rather than assuming.
 
 ## Exit codes