git-permission-guard: false positive blocks --no-edit as --no-verify

[JacobPEvans]

Bug

The DENY_GIT_ONLY regex for detecting --no-verify bypass on line 26:

(r"commit\s+.*(-n|--no-verify)", "bypasses pre-commit hooks"),

matches -n as a substring inside --no-edit, causing git commit --amend --no-edit to be incorrectly denied with:

BLOCKED: This command bypasses pre-commit hooks. Fix the underlying issue instead.

Reproduction

git commit --amend --no-edit  # BLOCKED (false positive)

Fix

Anchor -n as a standalone flag using word boundaries:

(r"commit\s+.*(\s-n\s|--no-verify)", "bypasses pre-commit hooks"),

Or use negative lookahead/lookbehind:

(r"commit\s+.*(?<!\w)(-n(?!\w)|--no-verify)", "bypasses pre-commit hooks"),

Context

Discovered while amending a commit on PR nix-ai#314 to fix GPG signing.