feat: add git fetch to safe commands

[linw1995]

Add git fetch to safe commands list with allow_any flag since it's a read-only operation.

Changes:

• Add git fetch to safe_commands.toml with allow_any = true
• Add comprehensive tests for various git fetch patterns (with/without remote, branch, flags)

This allows agents to fetch updates from remotes without requiring approval.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 48.11%. Comparing base (c3970cb) to head (fa82f54).
⚠️ Report is 6 commits behind head on dev.

Additional details and impacted files

@@            Coverage Diff             @@
##              dev     #168      +/-   ##
==========================================
+ Coverage   47.59%   48.11%   +0.52%     
==========================================
  Files         100      105       +5     
  Lines       27316    27914     +598     
==========================================
+ Hits        13000    13431     +431     
- Misses      14316    14483     +167     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.