fix(tools): derive valid git diff argv in sandboxed decorator

[Preciousuche]

Description

Closes #614

Summary

Fixes the @sandboxed argv_factory derivation for the built-in git_diff tool.

Problem

git_diff's @sandboxed decorator defined its argv_factory as:

argv_factory=lambda a: (
    "git",
    "diff",
    "--cached" if a.get("staged") else "--unstaged",
    str(a.get("path", "")),
)

This produced invalid arguments:

1. --unstaged is not a valid git flag.
2. When path is omitted (None), str(a.get("path", "")) stringifies None to "None".

While this tuple is not directly executed by the runner, it feeds sandbox action fingerprinting (sandbox/integration.py) and operator approval surfaces:

• Approval Safety & Auditability: Operators and audit logs are presented with git diff --unstaged None, misrepresenting the command that will execute.
• Fingerprint Equivalence: Fingerprints derived from invalid tuples misrepresent action equivalence across calls.

Solution

Replaced the inline lambda with _git_diff_argv(a) that mirrors the actual command construction in git_diff:

• Returns ("git", "diff")
• Appends "--cached" only when staged is truthy
• Appends ["--", str(path)] only when path is provided and non-empty

Tests

Added regression tests in tests/test_tools/test_git_workdir_policy.py verifying:

• Unstaged diff without path: ("git", "diff")
• Staged diff without path: ("git", "diff", "--cached")
• Unstaged diff with path: ("git", "diff", "--", "src/main.py")
• Staged diff with path: ("git", "diff", "--cached", "--", "src/main.py")

Fixes #614

[andreapn]

LGTM