fix(pi): refuse any Git-quoted path before the Babysit push

`core.quotePath=false` stopped Git escaping non-ASCII bytes, but it closed one
instance rather than the class. Git still quotes any path it cannot state on a
single line — one containing a newline, a double quote, a backslash, or a tab —
and such a path arrives with a leading `"`, so the `.github/` prefix test does
not match it and the refusal is bypassed exactly as before.

Refuse any quoted path outright. Unescaping instead would put a second
implementation of Git's quoting rules on the security-relevant side of the
push, and these characters have no legitimate place in a source path.

Author: icecrasher321

apps/sim/executor/handlers/pi/babysit-backend.test.ts

@@ -652,6 +652,34 @@ describe('runBabysitPiWithOptions', () => {
     expect(prepare?.command).toContain('core.quotePath=false')
   })
 
+  // `core.quotePath=false` stops the non-ASCII escaping but Git still quotes a path
+  // containing a newline, quote, backslash, or tab — which arrives with a leading `"`
+  // and so slips past a `.github/` prefix test. Any quoted path is refused outright.
+  it.each([
+    ['newline', '".github/workflows/new\\nline.yml"'],
+    ['double quote', '".github/quo\\"te.yml"'],
+    ['backslash', '".github/back\\\\slash.yml"'],
+    ['tab', '".github/tab\\tx.yml"'],
+  ])('refuses a %s path that Git could not report literally', async (_label, quotedPath) => {
+    mockFetchSnapshot.mockResolvedValue(snapshot)
+    mockFetchThreads.mockResolvedValue({
+      actionable: [trustedThread],
+      skipped: [],
+      totalUnresolved: 1,
+      latestReview: null,
+    })
+    mockFetchChecks.mockResolvedValue(greenChecks)
+    const { runner, runCalls } = makeRunner({
+      prepareStdout: `__CUMULATIVE_CHANGED__=${quotedPath}\n__CUMULATIVE_DIFF_BYTES__=20\n__CHANGED__=${quotedPath}\n__NEW_SHA__=${NEW_SHA}\n__NEEDS_PUSH__=1\n`,
+    })
+    mockWithPiSandbox.mockImplementation(async (callback) => callback(runner))
+
+    const result = await runBabysitPiWithOptions(params(), { onEvent: vi.fn() })
+
+    expect(result).toMatchObject({ stopReason: 'refused_content', commitsPushed: 0 })
+    expect(runCalls.some(({ command }) => command.includes('CURRENT_DIGEST='))).toBe(false)
+  })
+
   it('reports a hardened push rejection without losing partial counters', async () => {
     mockFetchSnapshot.mockResolvedValue(snapshot)
     mockFetchThreads.mockResolvedValue({

apps/sim/executor/handlers/pi/babysit-backend.ts

@@ -242,6 +242,23 @@ function trimUntrustedJson<T>(
   return { json: untrustedJson([]), omitted: payload.length }
 }
 
+/**
+ * Whether Git reported a path in its quoted form rather than literally.
+ *
+ * `core.quotePath=false` stops Git escaping non-ASCII bytes, but it still quotes
+ * any path it could not otherwise fit on one line — one containing a newline,
+ * a double quote, a backslash, or a tab. Such a path arrives with a leading `"`,
+ * so a prefix test like the `.github/` refusal below silently fails to match it.
+ *
+ * Refusing outright rather than unescaping: these characters have no legitimate
+ * place in a source path, and a decoder here would be a second parser of Git's
+ * quoting rules sitting on the security-relevant side of the push. A path Git
+ * declined to state plainly is one this code declines to push.
+ */
+function isQuotedGitPath(path: string): boolean {
+  return path.startsWith('"')
+}
+
 /**
  * Bounds a diff to the same ceiling Create PR applies to its own.
  *
@@ -547,6 +564,12 @@ async function finalizeRound(
       'Babysit cumulative change bounds were exceeded'
     )
   }
+  if (cumulativeChangedFiles.some(isQuotedGitPath)) {
+    throw new BabysitGitHubError(
+      'refused_content',
+      'Babysit refuses to push a path Git could not report literally'
+    )
+  }
   if (cumulativeChangedFiles.some((file) => file === '.github' || file.startsWith('.github/'))) {
     throw new BabysitGitHubError(
       'refused_content',