fix(git): avoid panic when parsing non-standard git version output

[ardittirana]

Fixes #4801.

Problem

CmdCheck extracts the git version with the regex \d+\.\d+\.\d+ and then indexes versionParts[0] and versionParts[1] without checking the length:

versionStr := regex.FindString(string(out))       // "" when no x.y.z match
versionParts := strings.Split(versionStr, ".")     // [""] -> len 1
major, _ := strconv.Atoi(versionParts[0])
minor, _ := strconv.Atoi(versionParts[1])          // panic: index out of range [1] with length 1

Some git builds report a non-numeric patch component, e.g. git version 2.52.gaea8cc3 (reported in the issue). The x.y.z regex finds no match, FindString returns "", and strings.Split("", ".") returns a one-element slice — so versionParts[1] panics with exactly:

panic: runtime error: index out of range [1] with length 1
.../pkg/sources/git/cmd_check.go:33

Fix

• Match only the major and minor components (\d+\.\d+). Those are the only parts the check uses, and this makes versions like 2.52.gaea8cc3 parse correctly (major 2, minor 52 → valid) instead of failing to match.
• Guard against output with no parseable version (return an error rather than indexing blindly).
• Extract the parsing/comparison into checkGitVersion(string) error so it can be unit tested.

No new dependencies (stdlib only).

Test

Adds cmd_check_test.go covering the previously-panicking dev-build string, the supported/boundary versions (2.20, 2.39, Apple suffix), out-of-range versions, and unparseable/empty output. Verified the dev-build case panics on main and passes with this change.

---

Note

Low Risk
Small, localized change to startup git version validation with added tests; no auth, data, or API behavior changes beyond failing safely instead of panicking.

Overview
Fixes a panic in CmdCheck when git --version reports a non-numeric patch (e.g. 2.52.gaea8cc3): the old x.y.z regex could return no match, leaving too few split segments and indexing versionParts[1] unsafely.

Version parsing now uses major.minor only (\d+\.\d+), returns a clear error when nothing parseable is found, and moves comparison into checkGitVersion for unit tests. cmd_check_test.go covers the dev-build case, supported bounds, Apple suffixes, rejections, and bad/empty output.

^{Reviewed by Cursor Bugbot for commit dbf210f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[CLAassistant]

All committers have signed the CLA.