don't keep working if "git pull" fails

Really, we should not be using `git pull`, because it will want to merge.  We should at least `--ff-only` as done in this commit.

Ideally we would either `git reset` instead, or have an option. Doing a reset, though, is a bit more work because the code will need to know the tracking branch, which I don't offhand know how to get quickly and correctly.  I wanted a lazy solution.

This fix will (a) reject non-ff updates from remote and (b) die, rather than continue, if the pull fails.