fix(init): match the push gate on command words, not literal text

[tupe12334]

Summary

The steplock init sample checklist, which is what every new user starts from, and the git-push-quality-gate example matched input.command.contains('git push'). That is a literal substring, so any global option between git and push skips the gate:

• git -C /path/to/repo push origin main: not gated
• git -c core.hooksPath=/dev/null push: not gated

I found this while running the global gate live in Claude Code: a git -C <dir> push went straight through. They now match on command_words, the way this repo's own .steplock/checklists/pre-push already does:

match_input = "input.command_words.exists(x, x == 'git') && input.command_words.exists(x, x == 'push')"

• Updated: the init sample (core/src/bin/main.rs), examples/git-push-quality-gate, Installation.md, examples/README.md, and the first schema example.
• Unchanged: the unit tests that exercise contains() itself, and the schema's other examples.

Test plan

• New regression test: the init sample blocks git -C /repo push origin main, git push, and cd x && git push -q, and still approves git status
• cargo test passes (115 lib, 36 bin, 18 cli, 11 integration); clippy with -D warnings and fmt --check pass
• steplock validate on examples/git-push-quality-gate: all checklists valid
• Live in Claude Code, using the same matcher in ~/.config/steplock: git -C <dir> push is now denied at step 1/2

🤖 Generated with Claude Code