test(security): Make the git-config e2e robust to a TMPDIR with spaces

fix(git-hardening-test): git runs diff.external through a shell, so an absolute payload path broke the positive control when the temp repo sat under a path with spaces; the driver now points at a relative ./pwn.sh, and marker paths inside the payload scripts are quoted. The gpg.program vector is exec'd directly, so it was unaffected, but its marker is quoted too for consistency. Verified by running the suite under a spaced TMPDIR.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>