fix(miner): validate commit SHA format in replay-snapshot path planner (#7796)

[RealDiligent]

Summary

• Add /^[0-9a-f]{7,40}$/i validation to normalizeCommitSha (matching replay-task-generation.ts) so path-traversal-shaped values are rejected before path.join()n- Normalize valid SHAs to lowercase for deterministic snapshot paths
• Regression tests for traversal-shaped input, too-short SHAs, uppercase normalization; update fixture SHAs across replay-snapshot tests

Closes #7796

Made with Cursor

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

❌ Patch coverage is 0% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 88.41%. Comparing base (17ae3e6) to head (e8a18cc).
⚠️ Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
packages/loopover-miner/lib/replay-snapshot.ts	0.00%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7841      +/-   ##
==========================================
- Coverage   91.37%   88.41%   -2.96%     
==========================================
  Files         729       89     -640     
  Lines       74688    21318   -53370     
  Branches    22793     3698   -19095     
==========================================
- Hits        68246    18849   -49397     
+ Misses       5396     2291    -3105     
+ Partials     1046      178     -868     

Flag	Coverage Δ
shard-1	?
shard-2	0.00% <0.00%> (-55.21%)	⬇️
shard-3	0.00% <0.00%> (-51.33%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
packages/loopover-miner/lib/replay-snapshot.ts	0.00% <0.00%> (-100.00%)	⬇️

... and 640 files with indirect coverage changes