fix(#3504): harden hook injection patterns and force-add guard (#3510)

* test(#3504): add failing-first parity, fail-closed, and bypass suites

* fix(#3504): harden hook injection patterns and force-add guard

* test(#3504): stage the scanner lib dependency in shared-hooks fixture

* chore(#3504): backfill changeset pr number

* test(#3504): build parity samples from fragments for the ci scan

---------

Co-authored-by: sim <sim@local>

hooks/lib/git-cmd.js

@@ -39,6 +39,7 @@ const { tokenizeShellLike } = require(path.join(__dirname, '..', '..', 'gsd-core
  */
 const ARGUMENT_TAKING_FLAGS = new Set([
   '-C',                // working directory
+  '-c',                // config override (separate-arg form: `git -c k=v …`; #3504)
   '--git-dir',         // path to git repository
   '--work-tree',       // path to working tree
   '--namespace',       // git namespace
@@ -102,6 +103,14 @@ function skipToSubcommand(tokens) {
       i += eqIdx !== -1 ? 1 : 2;
       continue;
     }
+    // #3504: glued `-ckey=value` form — git accepts the config override with
+    // its argument attached (`git -cfoo.bar=1 …`). The eq-slice above yields
+    // flagName `-cfoo`, which no set contains, so without this arm the walk
+    // stops and the whole invocation is misclassified as not-git.
+    if (/^-c\S*=/.test(t)) {
+      i++;
+      continue;
+    }
     if (BOOLEAN_FLAGS.has(t)) {
       i++;
       continue;
@@ -171,4 +180,4 @@ function isGitSubcommand(cmd, sub) {
   return tokens[subIdx] === sub;
 }
 
-module.exports = { isGitSubcommand, tokenize, extractBranchArgument };
+module.exports = { isGitSubcommand, tokenize, extractBranchArgument, skipToSubcommand };