fix: detect git push via subprocess wrappers (perl, python, node, ruby)

[royosherove]

Closes the perl workaround bypass by detecting subprocess wrappers in the push-guard.

Changes:

• Add containsGitPushInSubprocessWrapper() detector for perl -e, python -c, node -e, ruby -e
• Require BOTH git and push keywords present (eliminates false positives on unrelated commands)
• Exclude git stash push (not a remote push)
• Support multi-space separators in language flags

Result: Commands like perl -e 'system("git", "push", "origin", "main")' are now blocked.

Review iterations: 3 cycles, all findings addressed:

• Removed overly-broad keyword alternatives (os.system, subprocess, child_process, exec)
• Fixed regex ordering (git.*push only, not push.*git)
• Added stash exclusion to wrapper path
• Fixed flag spacing pattern

Code reviewed and ready to merge.