Fix false completion, escaping checks and filename/line-count handling

[Solarthis]

Improvements

1. Unchecked checklist items cannot pass when no verification command ran.
2. File checks reject lexical/realpath escapes and require regular files.
3. Git diff/status parsing is NUL-delimited; unusual filenames remain exact, and rename source/destination both reach guards.
4. Untracked symlinks are not followed for content counting.
5. Final newlines no longer add phantom lines to untracked change totals.

Verification

Four new regressions failed against original source. Full npm test now passes19 tests, including six new verifier cases; TypeScript build and diff check pass. All integrations use MockCodexClient / mock mode. CODEX_BIN was set to a nonexistent path as an extra guard: no Codex CLI, model inference, user computer or paid provider was used.

No new dependencies or sandbox/approval weakening. Real Codex integration, Windows process semantics and adversarial concurrent filesystem replacement remain unverified. Path checking is defense in depth, not a replacement for OS confinement. Draft only.