Fix five security scan findings

[Commanderx-code]

Change

Fixes five findings from a security scan of e7163bb. There is one commit per finding, and each commit adds its own regression test.

• Per-file diffs could run a submodule's own git filters (medium). platform::git added --ignore-submodules=dirty only when args[0] was status or diff. diff_file passes --literal-pathspecs as its first argument, so the guard was skipped. Opening the Unstaged diff of a staged submodule then let git run git status inside that submodule, and a filter defined in the submodule's config could execute a command. The wrapper now treats leading -- options as global options and applies the guards to the real subcommand.
• Recovery notes read had no size limit (low). A settings path such as /dev/zero, which an imported setup bundle can supply, was read without limit before the 256 KB check ran. The read now refuses anything that is not a regular file and stops at 256,001 bytes.
• settings.json and its backup were world-readable (low). Both files were written with the umask default, usually 0644. They now go through platform::atomic_write and are created with 0600.
• REST-server credentials reached restic's argv (low). The embedded-password check parsed rest:https://user:pass@host as an opaque rest URL, so it never saw the password. It now also checks the address after the rest: prefix.
• Job output cleaning could freeze the renderer (low). In cleanOutput's OSC regex, /\x1b\][^\x07]*(?:\x07|\x1b\\)/g, the body could run past later ESC bytes. A flood of unterminated ESC ] pairs in git sideband output from a hostile remote therefore made it backtrack quadratically. Because the job stays in activity history, the renderer froze on every launch. An indexOf scan replaces the regex. It produces exactly the same result (the first BEL after the introducer, otherwise the last ST) in linear time.

Validation

• cargo test: 71 passed, including 4 new regression tests. Each new test fails on the unpatched code.
• cargo clippy --all-targets -- -D warnings: clean.
• npm test: 78 passed, including 2 new cleanOutput tests. One pins the existing output, the other checks a 2 MB flood.
• npm run check: passed.
• cleanOutput was compared against the original regex on 500,000 random inputs built from ESC, ], \, BEL, CSI characters and CR/LF, with no differences. Adversarial 2 MB inputs finish in 1–3 ms.
• Each Rust patch was also reviewed independently for scope, new attack paths and behaviour changes.

Review notes

• Behaviour change (F4): a rest: Restic repository with a password in the address is now refused, with the existing error that points to Restic's credential environment. Move those credentials to RESTIC_REST_USERNAME and RESTIC_REST_PASSWORD.
• A per-file Unstaged diff of a submodule with local edits no longer shows the -dirty marker. This matches the file list and the full diff view, which already had the guard.
• Recovery notes paths that point at a device, FIFO or directory now return "Recovery notes must be a regular file".
• Existing 0644 settings files are tightened to 0600 the next time settings are saved, not when the app starts.
• Job output displays exactly as before. The cleanOutput change affects only speed.

🤖 Generated with Claude Code