wrapper-guard tests: cover the shapes I had only reasoned about

Test-only. No change to the guard; every case below already behaves
correctly at 46f52eed. They are committed because reasoning that a shape was
already covered is exactly what produced rounds four and five, and an
unmeasured belief about a security control is worth nothing.

Three fail at df83a9ee and pass here, so they discriminate:

    \curl --config /tmp/w.cfg              escaping the leading character
    cur"l" --config /tmp/w.cfg             the quote at a different offset
    g"h" api -X POST "repos/a/b/$EP" …     both halves dressed at once

`\curl` is the ordinary way to bypass a shell alias. It is a thing people
type, which makes it the least hypothetical entry in the file, and it was
not covered by any of the eight fixtures added in the previous commit.

The last one is the case I would have bet on breaking: the name gate reads
the normalized copy while the unreadable-endpoint tail reads RAW text, so
dressing BOTH halves at once is the input where those two readings are most
likely to disagree. They do not — the tail matches through the quote — but
the previous commit's message asserted that from reading the regex rather
than running it, and one round earlier the same kind of assertion was wrong.

Four negatives pass at BOTH heads and are here as regression guards: a
quoted read, an ordinary download, `gh --version` with no api subcommand,
and the word curl inside a string with no flag. Over-blocking is a real
failure and not a safe direction — a guard that refuses legitimate work gets
routed around instead of repaired, which costs more than the bypass it was
protecting against.

Suite 173/173.

packages/mosaic/framework/tools/git/test-wrapper-guard.sh

@@ -337,6 +337,23 @@ FIXTURES="$TMP/fixtures.tsv"
   printf '2\t{"tool_input":{"command":"g\\"h\\" api -X POST repos/a/b/$EP -f title=x"}}\tand so is a quoted one, which is where the two halves disagreed\n'
   printf '0\t{"tool_input":{"command":"mygh api -X POST repos/a/b/$EP -f title=x"}}\tmygh is still not gh, in the refinement as well as the gate\n'
 
+  # Shapes nobody raised. Written down because reasoning that they were already
+  # covered is precisely what produced two of the rounds above; each one below
+  # was measured, and the three that fail at df83a9ee are here on that evidence.
+  # `\curl` is the ordinary way to bypass a shell alias and is a thing people
+  # actually type, which makes it the least hypothetical entry in the file.
+  printf '2\t{"tool_input":{"command":"\\\\curl --config /tmp/provider-write.cfg"}}\tescaping the leading character to dodge an alias still names curl\t--config/-K\n'
+  printf '2\t{"tool_input":{"command":"cur\\"l\\" --config /tmp/provider-write.cfg"}}\tthe quote may sit at any offset in the word\t--config/-K\n'
+  printf '2\t{"tool_input":{"command":"g\\"h\\" api -X POST \\"repos/a/b/$EP\\" -f title=x"}}\tboth halves dressed at once, which is where they last disagreed\n'
+
+  # Over-blocking is a real failure and not a safe direction: a guard that
+  # refuses legitimate work gets routed around instead of repaired. These four
+  # pass at both heads, which is what a regression guard is for.
+  printf '0\t{"tool_input":{"command":"gh api \\"repos/a/b/issues\\""}}\ta quoted read is still a read\n'
+  printf '0\t{"tool_input":{"command":"curl https://example.com/file.txt -o /tmp/f"}}\tan ordinary download is not a provider write\n'
+  printf '0\t{"tool_input":{"command":"echo \\"$EP\\" && gh --version"}}\tno api subcommand, so nothing to refuse\n'
+  printf '0\t{"tool_input":{"command":"echo \\"not a curl call\\""}}\tthe word inside a string, with no flag, is prose\n'
+
   # Percent-encoded endpoints. Not hypothetical: /issues/1174 and /iss%%75es/1174
   # both returned HTTP 200 with the same object from the live forge, so the
   # encoded spelling IS the wrapped endpoint and the literal comparison below it