fix: harden capture_patch and snapshot_untracked filename handling

[theSatvik]

Closes #2196 — both filename-handling gaps from the post-merge review of #2144.

What changed

1. Ignore entries reach git as literal pathspecs. capture_patch now prefixes each ignore entry with :(literal), so a pre-existing file named like a glob can no longer unstage the agent's unrelated changes (and a name starting with : can't be parsed as pathspec magic). This one is nastier than it sounds — reproduced against real git:

repo: agent edits agent_change.py; image ships a file literally named "*.py"
git reset -q -- '*.py'            → staged afterwards: []            (agent's work DROPPED from the patch)
git reset -q -- ':(literal)*.py'  → staged afterwards: [agent_change.py]

2. Lossily-decoded filenames fail loudly. Runtimes decode stdout with errors="replace", so a non-UTF-8 filename reaches snapshot_untracked with U+FFFD substituted — it can never match the real file again, the file silently stays out of the ignore set, and the captured patch credits the agent with an image file. snapshot_untracked now raises a ValueError naming the problem instead of returning a name that guarantees a wrong patch. (Chose fail-explicitly over a bytes-level path because the runtimes' ProgramResult.stdout contract is str; happy to go the bytes route instead if you'd rather change that contract. The error message notes that a filename legitimately containing U+FFFD also trips this — the price of the lossy text contract.)

Tests

New tests/v1/test_git_utils.py (3 tests, scripted duck-typed runtime): literal-pathspec argv including the *.py / weird[name].txt / leading-: cases, normal NUL-split round-trip, and the U+FFFD rejection. I know AGENTS.md discourages new unit-test files, but the issue's "Done when" explicitly asks for focused coverage of glob metacharacters and non-UTF-8 bytes — these can't be exercised through the e2e suite without a sandbox image shipping hostile filenames (and macOS dev machines can't even create the non-UTF-8 case on APFS).

uv run pytest tests/v1/test_git_utils.py — 3 passed; ruff check / ruff format / pre-commit on touched files — clean.

Note

Harden filename handling in capture_patch and snapshot_untracked

• In capture_patch, ignore entries are prefixed with :(literal) to pass them to git as literal pathspecs, preventing globbing or pathspec magic.
• In snapshot_untracked, the function raises a ValueError if git ls-files -z stdout contains the Unicode replacement character to detect non-UTF-8 filenames.
• Risk: snapshot_untracked now raises ValueError on non-UTF-8 filenames instead of returning lossy names; capture_patch changes how ignore entries are matched (from glob/magic to literal).

^{Macroscope summarized 4af3f02.}