…ction

Source-descriptor fields flow into the `git` argv via `execFileSync`:
`repo`/`url` reach `git clone`/`git fetch` and `ref`/`sha` reach
`git checkout --detach <wanted>`. `execFileSync` avoids a shell, but `git`
itself treats a leading-`-` argument as an option (e.g. a `ref` of
`--upload-pack=<cmd>`), so an option-like value is a second-order argument
injection (CodeQL js/second-order-command-line-injection, 3 high alerts in
src/resolve.ts).

Extend the `reqArg` guard (reject a leading `-`) to every source field that
reaches the git argv, applied in `normalizeSource` before any git invocation:
- `reqArg` on github.repo, git.url, git-subdir.url, url.url
- new `optArg` on the optional ref/sha of every git variant (rejected rather
  than escaped, since `git checkout` does not accept `--` cleanly before a ref)

`resolveSource` already calls `normalizeSource` first, so the guard runs ahead
of clone/fetch/checkout for all three alert sites.

Spec: add FR-004-CON-3 + FR-004-AC-8 (argv injection guard) and TC-022 rows;
src/** stays at 100% coverage; quire validate clean.

Closes #6

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Reconcile the git argv-injection hardening (PR #8) with the npm source
resolution that landed on main (PR #3).

- src/sources.ts: unify to one trimmed `reqArg` guard used on both the npm
  `package` field (#3) and the git argv fields (#8: repo/url/path + optArg
  on ref/sha).
- spec/functional/FR-004: keep #3's npm ACs/CONs; renumber #8's additions
  after the highest existing id — CON-3→CON-5, AC-8/9/10→AC-14/15/16.
- spec/tests.md: renumber #8's git TCs after the npm block —
  TC-022/023/024→TC-029/030/031; update FR-coverage, Test Index, Constraint
  Boundary, Error-Path tables and coverage counts.
- tests/index.test.ts: update the three guard tests' TC tags to
  TC-029/030/031 so spec and code agree 1:1.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>