validate-git-c: add test harness for hook decision paths

The hook has no test coverage. The recent reorder fix (metachar check moved after whitelist check) was a logic change that would have been caught by tests. Minimum test cases: 1. Path traversal in -C arg -> deny 2. Non-whitelisted command with heredoc message -> ask 3. Whitelisted command with semicolon injection -> deny 4. Clean whitelisted command -> allow Consider bats (Bash Automated Testing System) or a simple shell test script that feeds JSON input to the hook and asserts the output decision. Priority: Medium -- prevents regression on security-critical hook logic.