fix(cli): treat staged paths literally

[andrei-hasna]

Summary

PR #8 merged while its exact-head adversarial review had one open blocker: a staged filename using Git pathspec magic could suppress its own added hunk. This follow-up contains only that remediation.

• force literal pathspec handling for each staged file passed to git diff
• add a three-way regression: pathspec-magic known-positive, normal-path known-positive, and safe negative

Verification

• focused RED before fix: 0 pass, 1 fail; magic filename returned no findings
• focused regression after fix: 1 pass, 0 fail, 10 assertions
• affected command/scanner group: 98 pass, 0 fail, 170 assertions
• complete matrix: 437 pass, 0 fail, 7035 assertions
• bun run typecheck: pass
• strict OSS secrets policy: 0 violations
• git diff --check origin/main...HEAD: pass
• pre-push hook: scanned 1 outgoing commit
• candidate tree matches the fully tested remediation tree exactly

Incident record: conversations #incidents message 678928.

Todos: SHI-00001 (d0bb42cb-27a2-42f0-96e4-afcc59f3147e)

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}