push gate: a feature push after a heredoc commit message is refused #20845

KiroCrew version

main @ a790373 (also the head of #15438)

Platform

Linux / macOS / Windows (pure-Python argv floor, platform-independent)

What happened

A feature-branch push that follows a heredoc commit message in the same command is refused by the git-publish floor:

git commit -m "$(cat <<'EOF'
subject

body
EOF
)" && git push origin feat

Refusal: rule=git-publish-target-unverifiable (with #15438 applied, the refusal also carries the "put the push on its own line" hint).

This is the commit form many coding agents emit by default, so the agent gets refused and retries.

#15438 lets a newline stay inside a literal quoted commit message (-m '...' / -m "..." with no $, backtick or \). A $(cat <<'EOF' ...) message is outside that closed allowlist on purpose: it is a command substitution plus a heredoc, which the per-line reading still splits, so the push line is still read as possibly fused with message text.

Steps to reproduce

from kiro_crew.security import is_denied
is_denied("git commit -m \"$(cat <<'EOF'\nsubject\n\nbody\nEOF\n)\" && git push origin feat")
# -> Blocked by security policy: ... rule=git-publish-target-unverifiable

Expected

Allowed, the same as the same commands with the push on its own line (already allowed on main):

git commit -m "$(cat <<'EOF'
subject
EOF
)"
git push origin feat

while a heredoc body that hides a push to a protected branch stays refused.

Workaround

Put the push on its own line.

Anything else

Follow-up from #15438 (one of its listed non-goals). Refs #12631.