[hamzafer]

Follow-up to #178.

Change

• One reading: plainShape hands back the command with its heredoc message blanked, and addPaths reads that string, so no later pass can end the heredoc somewhere else.
• Quotes read in one pass from the left: bare() used to blank single quotes before double ones, so an apostrophe inside double quotes (-m "it's") could pair with a later quote and hide what sat between. It now reads both kinds at once and skips escaped characters, as the shell does. A few commits it used to miss (a cd "it's dir", a message with ' inside "…") are now checked.
• Fails closed on a << left anywhere in the command, and on commands over 20,000 characters: every new file is read, as before secret-guard: a commit scans only the untracked files its git add names #178.
• Cleans up 5 strict-index type warnings in the same functions.
• Version 0.1.2 → 0.1.3 (plugin.json, marketplace, site page); docs list the long-command case.

Tests

• New cases for each of the above; claude plugin test mods/secret-guard passes 40/40, repo tests pass.