Fix list breaking when the server's du fails

Two mistakes in the size support, reported from a real server.

The remote command used "2>/dev/null" to silence du. That is sh syntax,
and the git user's login shell need not be sh: in csh it parses as an
argument "2" followed by a redirection of stdout, so du was handed a
file named "2", complained, and exited non-zero. The redirection is
gone -- without it there is no bogus argument to trip over, and the
command now uses nothing that differs between sh and csh.

Worse, the exit status of the chain is the *last* command's, so that
failing du made sshOut return an error and `list` threw away a listing
that had arrived perfectly intact. It now reports a failure only when
nothing usable came back at all; a listing that parsed is shown whatever
the exit status, simply without the size column.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

remotecmd_test.go

@@ -329,3 +329,65 @@ func mustGit(t *testing.T, dir string, args ...string) {
 		t.Fatalf("git %v: %v\n%s", args, err, out)
 	}
 }
+
+// TestListSurvivesFailingDu: `list` chains the listing and `du` into one remote
+// command, and the exit status is the *last* command's. A server whose du fails
+// — a shell that mis-parses the arguments, a du that is not there, a permission
+// problem — must still get its repositories listed.
+func TestListSurvivesFailingDu(t *testing.T) {
+	useProject(t, "x")
+	fakeServer(t, func(cmd string) (string, error) {
+		return "total 4\n" +
+				"drwxr-xr-x 7 git git 4096 Jan  3 14:32 notes.git\n" +
+				"drwxr-xr-x 7 git git 4096 Sep 28  2016 website.git\n" +
+				listMarker + "\n",
+			errors.New("exit status 1") // du blew up, ls did not
+	})
+
+	out := captureStdout(t, func() { runCommand("list") })
+
+	if strings.Contains(out, "could not list") {
+		t.Errorf("a failing du discarded a good listing:\n%s", out)
+	}
+	for _, want := range []string{"notes", "website", "2 repositories"} {
+		if !strings.Contains(out, want) {
+			t.Errorf("listing missing %q:\n%s", want, out)
+		}
+	}
+	// without sizes there must be no size column, not a column of zeroes
+	if strings.Contains(out, "0B") {
+		t.Errorf("zero sizes shown when du produced none:\n%s", out)
+	}
+}
+
+// TestListReportsATrulyFailedListing: when nothing usable came back, the error
+// still has to surface.
+func TestListReportsATrulyFailedListing(t *testing.T) {
+	useProject(t, "x")
+	fakeServer(t, func(cmd string) (string, error) {
+		return "", errors.New("ssh: connect failed")
+	})
+	out := captureStdout(t, func() { runCommand("list") })
+	if !strings.Contains(out, "could not list") {
+		t.Errorf("a failed listing was not reported:\n%s", out)
+	}
+}
+
+// TestListSendsNoShellSpecificSyntax guards the bug this replaced: the remote
+// command is run by the git user's login shell, which may be csh, where
+// "2>/dev/null" is an argument followed by a redirection rather than a
+// redirection of stderr.
+func TestListSendsNoShellSpecificSyntax(t *testing.T) {
+	useProject(t, "x")
+	sent := fakeServer(t, func(cmd string) (string, error) { return "", nil })
+	captureStdout(t, func() { runCommand("list") })
+
+	if len(*sent) == 0 {
+		t.Fatal("list sent nothing")
+	}
+	for _, c := range *sent {
+		if strings.Contains(c, "2>") || strings.Contains(c, "&>") {
+			t.Errorf("remote command uses sh-only redirection: %q", c)
+		}
+	}
+}