git push hook regex false-positives on branch names containing "main"

[hbrodin]

The git push PreToolUse hook matches main/master anywhere in the command string, blocking pushes to branches that contain these as substrings:

git push -u origin deps/aiohttp-3.13.5-remaining  # blocked — "main" in "remaining"
git push origin feature/maintain-state              # blocked — "main" in "maintain"
git push origin fix/mainframe-bug                   # blocked — "main" in "mainframe"

The fix requires main/master to appear as a standalone ref target by checking the preceding character is a whitespace, colon (refspec), slash (fully-qualified ref), or + (force-push prefix):

-git[[:space:]]+push.*(main|master)
+git[[:space:]]+push[[:space:]].*([[:space:]]|:|/|\+)(main|master)([[:space:]]|$)

This matches the rigor level applied to the rm hook in #33.

Blocked:

• git push origin main
• git push -u origin main
• git push origin feature:main (refspec)
• git push origin refs/heads/main (fully-qualified)
• git push origin +main (force prefix)
• git push origin HEAD:refs/heads/main

Allowed:

• git push -u origin deps/aiohttp-3.13.5-remaining
• git push origin feature/maintain-state
• git push origin fix/mainframe-bug
• git push (bare push to tracking branch)

[e-q]

One form isn't in either list: git push origin HEAD / git push -u origin HEAD. There's no main substring for the pattern to match, so it's allowed, but when you're checked out on main, it pushes to main. You'd have to resolve the current branch to do this, which is much more involved