test: cover the behaviour that was shipping unverified

[pixincreate]

Stacked on #89 — top of the stack.

Summary

Closes the coverage gaps where a regression would have shipped green, and makes CI run KeyWatch against itself.

Changes

• git_available() silently skipped 12 tests — every --staged and baseline integration test — if git were missing. Git is a hard dependency of those modes, so it now fails loudly instead of reporting green while covering nothing.
• The staged git-config hardening had no test, despite being the fix for a real bypass. Deleting any of the five overrides made the scan report clean or attribute findings to a mangled path, and nothing failed. One test now sets color.ui=always, diff.mnemonicPrefix, diff.noprefix, core.quotePath and diff.relative simultaneously and asserts the path and line survive.
• Newly covered: the scanner exits 2 outside a repository (what makes the hook fail closed); path operands actually narrow the staged diff; a config at the repo root is discovered (depends on candidate lookup preceding the .git stop check — both prior tests passed either way); and the prefilter selects both owners of overlapping keywords, without which Stripe detection silently stops running behind Adyen's shorter sk_.
• CI never ran KeyWatch on KeyWatch, so a committed secret or a stale baseline would ship green. New self-scan job scans the repo, fails if the committed baseline has drifted, and checks the framework hook entry still uses scan --staged.

Tests

192 pass (was 177 at the base of this stack), clippy and fmt clean.