fix: quote user queries for FTS search

[andrei-hasna]

Summary

• Reproduce repos search repo-project-familiarization --json failing with SQLiteError: no such column: project.
• Quote whitespace-delimited user terms before SQLite FTS5 MATCH evaluation, including repo, commit, and pull-request searches.
• Add a regression for a hyphenated known-present repo name and a hyphenated absent query.

Verification

• bun test src/db/repos.test.ts — 37 pass, 0 fail
• bun test — 784 pass, 0 fail
• bun run typecheck — exit 0
• bun run build — exit 0
• Built CLI search open-repos --json — returns the open-repos record
• Built CLI search repo-project-familiarization --json — returns []
• Staged secrets scan — no configured credential patterns matched

Task: 2b54e97f-49ca-4940-ac97-a2c490076906
Exact head: b2c79fa
Rollback: revert commit b2c79fa if the change must be withdrawn.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

NO_GO — required acceptance criterion (2) is not met.

Blocking defect:

• The PR adds quote escaping in src/db/repos.ts:406-413 (term.replaceAll('"', '""')), but src/db/repos.test.ts:240-250 covers only hyphenated repo text and an absent hyphenated term. There is no focused regression for an embedded/unmatched double quote, so the required escaping behavior is unguarded and the stated acceptance gate is incomplete.

Evidence:

• Exact head verified: b2c79fa21b40d1d155e44ae597df562a321aa9e0.
• Raw focused test line: (pass) repos > treats punctuation in repo search queries as literal text [3.53ms].
• Raw independent escaping probe: QUERY "quote\\"repo" => ["quote\\"repo"].
• Raw CLI probe: QUERY "repo-project-familiarization" => ["repo-project-familiarization"] and rc=0.
• Raw gate line: Typecheck, Test & Build pass 55s.

Please add a focused test that exercises a query containing " (and asserts the expected result or no throw), then rerun the affected test lane and required CI gates.

[andrei-hasna]

Remediation cycle 1 complete.

New exact head: bbcb93c

Added one focused regression covering embedded double quotes across all three changed FTS search surfaces; no production code changed.

Raw focused test lines:

(pass) FTS query escaping > treats embedded double quotes as literal input across search surfaces [3.87ms]
 38 pass
 0 fail
 75 expect() calls
Ran 38 tests across 1 file. [182.00ms]

Typecheck raw line:

$ tsc --noEmit

Staged secret scan: staged secret scan clean: no configured credential patterns matched

Ready for focused re-review of the named quote-escaping regression gap only. STOP before merge.

[andrei-hasna]

[REVIEW] GO — focused remediation-cycle-1 verification for exact head bbcb93cb7f799cdf4e3fb9cfbbb25cacf7b5c00a.

The named blocker is fixed. Commit bbcb93c is test-only and adds an embedded-double-quote regression that exercises all three production surfaces using buildFtsQuery: searchRepos, searchCommits, and searchPullRequests. No direct P0/P1 regression was found.

Raw focused pass lines:

• (pass) FTS query escaping > treats embedded double quotes as literal input across search surfaces [6.81ms]
• 1 pass
• 0 fail
• 3 expect() calls
• rc=0

Raw required gate line:

• Typecheck, Test & Build pass 59s

Head check immediately before review:

• bbcb93cb7f799cdf4e3fb9cfbbb25cacf7b5c00a OPEN