fix(vuln-poc-gate): a PoC must live in the PoC dir, and files it creates count as mutation

[Svector-anu]

vuln-poc-gate.sh is the evidence gate for HIGH/CRITICAL findings, so what it accepts as a PoC matters. two ways around it:

• the PoC path was checked against POC_DIR by a prefix match on the spelled path. $POC_DIR/../x.sh passed, and so did a link inside POC_DIR to a script elsewhere, so a script from outside the PoC dir ran and was recorded as the verifier.
• command mode looked for target changes with git diff / git diff --cached, which cannot see a file the script creates. a PoC that wrote into the target checkout still came out verified.

changes (scripts/vuln-poc-gate.sh)

• poc_file canonicalises the file's directory and POC_DIR (pwd -P), requires the file to sit under it, and refuses a file that is itself a link. both the command script and the foundry test file go through it, and the canonical path is what runs / is copied
• command mode takes git status --porcelain --untracked-files=all before the run and compares it after, on top of the existing diff checks. files that were already untracked do not count; new ones fail the run as target-mutated (exit 21)

tests (test_vuln_poc_gate.sh): .. escape is refused and the script does not run; a link in the PoC dir is refused; a script behind a linked directory is refused; a PoC that creates an untracked file fails with exit 21; a pre-existing untracked file does not break verification. four of the five new checks fail on main (the pre-existing-file one is a guard that passes on both). the suite passes in full; shellcheck has nothing at error severity and scripts/lint-shell.sh is clean.

not covered

• exit 0 alone still verifies a command-mode PoC. the gate cannot tell a real reproduction from exit 0; requiring the script to print a marker would make a careless PoC fail but not a deliberate one, and it changes what vuln-scanner writes, so i left it as a question for you.
• the PoC still runs with the runner's HOME; on a runner that holds no credential files there this is low, but a laptop run could read them.
• foundry mode still checks target changes with git diff only: forge writes cache/ and out/ into the checkout, so the untracked comparison would need an allowlist for those.
• live_vuln_poc_gate.sh needs network and was not run.