Fix single-file git path confinement

[cursor]

Summary

Fixes a critical path confinement bug in single-file git operations:

• Reject absolute, empty, and parent-traversing filenames before commitFile / discardFile mutate git state or the worktree.
• Reject existing paths whose parent resolves outside the repository, covering symlink-directory escapes.
• Restore tracked files with git2 exact-path matching instead of pathspec matching.
• Add regression tests for absolute path deletion, .. traversal, symlink-directory escapes, and the valid repo-relative untracked discard path.

Test Plan

• cargo +stable test -p nixmac git::exec::tests -- --nocapture
• cargo +stable test -p nixmac

Docs

10|

• No docs update needed