Guard plugin-add against git transport-helper URLs (match theme-install) (#8067)

* Guard plugin-add against git transport-helper URLs

omarchy-plugin-add cloned a user-supplied git URL without the
transport-helper guard that omarchy-theme-install already applies
(added in #7884, which did not touch plugin-add). Port that guard
(reject ext::/fd:: and leading-dash forms, keep https/ssh/scp-style
incl. IPv6) and add a regression test. Stock systems are unaffected
(git default protocol.ext.allow=never); this removes the silent
dependency on that default and aligns the two install paths.

* Test the plugin-add guard's leading-dash arm via the gum input path

The prior leading-dash cases only exercised the argv option parser, not
the guard (removing the guard's -* arm left them green). Drive a dash
value through the interactive gum prompt under a pty so the post-input
guard is actually covered; skip cleanly where util-linux script is
unavailable.

bin/omarchy-plugin-add

@@ -93,6 +93,15 @@ if [[ -z $url ]]; then
   [[ -n $url ]] || fail "a git URL is required"
 fi
 
+# git reads a leading dash as an option, and `<helper>::<address>` as a remote
+# helper to run at clone time. Reject both so an untrusted URL cannot smuggle a
+# transport helper that executes before the plugin is validated or enabled. An
+# scp-style IPv6 host such as git@[2001:db8::1]:org/repo.git carries `::` too and
+# must still clone.
+if [[ $url == -* || $url =~ ^[A-Za-z0-9][A-Za-z0-9+.-]*:: ]]; then
+  fail "'$url' names a git option or transport helper, not a repository."
+fi
+
 if (( ! ASSUME_YES )); then
   cat >&2 <<WARN