CodeQL alert #33 (Critical): exec.Command("git", ...) in runGit
received user-controlled strings (commit message bytes from author /
subject, and paths from note keys). Although exec.Command uses argv
(no shell) which makes the standard shell-injection vector inert, git
itself has flag-based attack surface (e.g. `--upload-pack=cmd`,
`-c core.sshCommand=...`) that CodeQL is right to flag.

Defense in depth:

1. `runGit` now enforces:
   - notesDir must be non-empty and must not start with "-" (prevents
     it being parsed as a git top-level flag).
   - args[0] must be in a closed allow-list of subcommands (init /
     config / add / log). Commit is deliberately routed elsewhere
     (see #2).
   - Any arg after a literal "--" must satisfy filepath.IsLocal —
     this continues the sanitiser from PR #44 and is what CodeQL
     recognises.

2. `gitCommit` is a new helper that runs `git commit --no-gpg-sign
   -F -` and pipes the message via stdin. The message bytes therefore
   never appear in argv, cutting the only remaining taint flow from
   user input to exec.Command args.

3. autoCommit's commit call switched from runGit(..., "commit", "-m",
   msg) to gitCommit(notesDir, msg).

Tested locally: 104/104 tests passing in internal/notes/.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>