fix: block all git push to protected branches, not just force push

[endavis]

Description

The block-dangerous-commands.py hook only blocked force pushes to protected branches. Regular git push while on main was allowed, letting AI agents push directly to main bypassing the PR workflow.

Also fixes a false positive where git stash push was incorrectly matched as git push.

Addresses #307

Type of Change

• Bug fix (non-breaking change which fixes an issue)

Changes Made

• Renamed check_force_push_to_protected → check_push_to_protected
• Now blocks ANY git push when current branch is protected (main/master)
• Added subcommand check: only git push is matched, not git stash push
• Still allows pushing to feature branches while on main (git push -u origin fix/123)

Testing

• Manually tested all scenarios: bare push on main (blocked), push to feature branch (allowed), git stash push (allowed), explicit push to main (blocked)

[github-actions]

Benchmark

Details

Benchmark suite	Current: c450349	Previous: 5486031	Ratio
tests/benchmarks/test_bench_core.py::test_bench_greet_default	8889541.225256031 iter/sec (stddev: 1.1520710667598202e-8)	8166984.352580131 iter/sec (stddev: 1.2600047111595168e-8)	0.92
tests/benchmarks/test_bench_core.py::test_bench_greet_with_name	8876003.404447401 iter/sec (stddev: 1.0900137899848911e-8)	8306651.00208249 iter/sec (stddev: 1.0151140556058403e-8)	0.94
tests/benchmarks/test_bench_core.py::test_bench_greet_long_name	5495310.254050291 iter/sec (stddev: 3.467121077901487e-8)	5593233.539409745 iter/sec (stddev: 1.4238505859520605e-8)	1.02
tests/benchmarks/test_bench_logging.py::test_bench_get_logger	1697542.1975712706 iter/sec (stddev: 2.360904760311015e-7)	1683086.6830090855 iter/sec (stddev: 2.0472155012615866e-7)	0.99
tests/benchmarks/test_bench_logging.py::test_bench_setup_logging	502234.6146149284 iter/sec (stddev: 5.242133122140792e-7)	488272.1664871446 iter/sec (stddev: 4.338613854146437e-7)	0.97

This comment was automatically generated by workflow using github-action-benchmark.