Fix Git Push Non-Fast-Forward and Permission Denied Errors - How to Replace Cloudflare Origin Cert with Let's Encrypt-Nginx Upstream Connection Refused on Port 443 Fix

Decision checklist

• Match the tool to the workflow that fails most often, not only the feature list.
• Keep export format, permissions, and automation limits in the final decision.