The commit handler ran `git add <paths>` followed by `git commit`
without a pathspec, so anything pre-staged externally before the
handler ran was swept into the commit. #2767 fixed every call site
to use --files but left the handler emitting a pathspec-less commit,
so the bug survived the well-formed form too.
Compute pathsToCommit once and pass `'--', ...pathsToCommit` to every
git commit invocation: regular, --amend, and commit-to-subrepo. The
staged-files check uses the same pathspec so "nothing staged" reflects
what would actually be committed, not unrelated index entries.
Two follow-up safeguards on the same surface:
* When `--files` is passed but every following token gets filtered out
(e.g. `--files --no-verify`), reject with `--files requires at least
one path` instead of silently falling back to .planning/.
* Both `git add` invocations now use the `--` separator so a path
starting with `-` (e.g. a file literally named `-A.md`) is treated
as a pathspec rather than a git option.
Adds five regression tests in `commit.test.ts`: three covering the
pathspec scope (`--files`, `.planning/` fallback, and `--amend` with
pre-staged unrelated changes), one covering the empty `--files`
rejection, and one covering the `-A.md` round-trip.
Closes#3061
