when refreshing upstream, use push URL

when refreshing upstream, use push URL

Part of the release process involves pushing to the git remote, so try
to validate that early. We can't do an actual push early, to verify the
permissions, but we can at least verify that the push URL works.

This can be a problem when using different URLs for pull vs push, like
https for pull and ssh for push. If you are on a restricted network, one
may fail while the other would work.