fix(governance): prevent argument injection in rollbackPrompt

- Validate `hashOrStrategy` to ensure it does not start with `-`.
- This prevents argument injection when falling back to `git checkout` via `execFileSync`.
- Although `execFileSync` prevents shell command injection, argument injection was still possible (e.g., `--help`).
- Verified with reproduction script.

Co-authored-by: PR0M3TH3AN <[email protected]>

src/services/governance/index.js

@@ -354,6 +354,9 @@ export async function rollbackPrompt(target, hashOrStrategy = 'latest') {
   // Fallback to Git
   try {
     const commit = hashOrStrategy === 'latest' ? 'HEAD' : hashOrStrategy;
+    if (commit.startsWith('-')) {
+      throw new Error(`Invalid commit/strategy: ${commit} (cannot start with '-')`);
+    }
     execFileSync('git', ['checkout', commit, '--', target]);
     return { success: true, source: 'git', restored: commit };
   } catch (e) {