Fail closed command guard diagnostics and scans

[Widthdom]

Summary

• Fail closed in Codex hook adapters when hook payloads are malformed, missing commands, or cannot resolve the git project root.
• Fail closed in command guard script scanning for missing candidate scripts and over-limit script files, while preserving safe Python module test invocations and scanning Python module script runners.
• Fail closed for staged secret checks when gitleaks is unavailable, and route git commit aliases/global-option forms through the staged secret check.

Validation

• python3 -m unittest discover -s .agent_harness/tests
• dotnet build
• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll index . --commits HEAD --json
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
• Codex adversarial review was run; findings around git alias commit detection and Python module script-runner scanning were fixed in follow-up commits.

Changelog

• changelog.d/unreleased/3476.fixed.md
• changelog.d/unreleased/3477.fixed.md
• changelog.d/unreleased/3478.fixed.md

Fixes #3476
Fixes #3477
Fixes #3478

Refs #3608