Remove case normalization from normalizeCommand to close command-bypass vulnerability

[Copilot]

Lowercasing in normalizeCommand allowed a case-variant command to pass hash verification while the injector executed the original casing — on a case-sensitive filesystem, ECHO and echo can be different executables.

Changes

• src/core/command-hash.ts — removed .toLowerCase() from normalizeCommand; whitespace normalization (trim + collapse) is preserved as it is semantically neutral
• src/__tests__/command-hash.test.ts — removed lowercase-specific test cases; updated round-trip test to reflect case-preserving behavior

// Before — grants approved for "cat myfile.txt" would match "cat MyFile.txt"
const normalized = cmd.trim().replace(/\s+/g, ' ').toLowerCase()

// After — case is preserved, hash comparison is strict
const normalized = cmd.trim().replace(/\s+/g, ' ')

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.