`block-force-push` misses combined `-fu` and wrongly blocks the safe `--force-with-lease`

[chhhee10]

Description

block-force-pushmatches git-push arguments againstFORCE_PUSH_RE (src/hooks/builtin-policies.ts:175`):

const FORCE_PUSH_RE = /(?:--force|-f\b)/;

Matching against substrings of flags (rather than parsed tokens) produces two opposite defects.

Steps to Reproduce

A — dangerous force-push slips through (false negative):
git push -fu origin main is allowed. Git lets short flags be bundled (-f force + -u
set-upstream); after -f comes u, so -f\b finds no word boundary and fails to match.

B — the safe variant is blocked (false positive):
git push --force-with-lease is denied, because the string contains --force. But
force-with-lease is the recommended safe force-push — it refuses if the remote moved, so it's
exactly what you'd want to allow.

Expected Behavior

• git push -fu … (and other bundled short flags containing f) should be denied.
• git push --force-with-lease[=…] should be allowed (or at least treated distinctly from a
  blind --force).

Failproof AI Version

0.0.14-beta.1

Node.js / Bun Version

Bun 1.3+

Operating System

macOS

Additional Context

Parse the push args into tokens and match flags precisely: detect --force (exact, not
--force-with-lease), --force-with-lease as its own case, and bundled short flags via something
like /^-[a-z]*f[a-z]*$/. Add tests for -fu, -f, --force, and --force-with-lease.