fix(git): harden blob-show decode, metrics, recovery, and stderr (review non-blockers)

N1: emit small blobs (<= 8 KiB) as git's raw bytes with no decode, so a
    passthrough blob keeps its BOM.
N2: derive the recovery hint from the blob arg itself
    (`git show <rev>:<path> | tail -n +N`) instead of a tee file, so the
    windowing works for blobs larger than the tee's max_file_size cap; drop
    the MaxRecoverable cap and tee::max_recoverable_bytes entirely.
N3: track savings against the raw bytes git wrote, not the transcoded text,
    via TimedExecution::track_bytes (avoids overstating the reduction).
N5: decode captured stderr with decode_process_output, not from_utf8_lossy.
N6: skip windowing when stdout is not a TTY — truncation changes the bytes a
    piped consumer receives, not just the on-screen presentation.
N8: window the token-savings test against a committed deterministic fixture
    instead of include_str!(main.rs).
N9: replace bare see-also doc pointers with the real rationale.
N10: surface git's stderr on success too, not only on failure.

N4/N7 do not apply: with N2 this path no longer writes a tee file, so there
is no tee-write ordering to fix nor a tee.mode to honour here.