git push hook regex false-positives on branch names containing "main"

The git push PreToolUse hook matches main/master anywhere in the command string, blocking pushes to branches that contain these as substrings:

git push -u origin deps/aiohttp-3.13.5-remaining  # blocked — "main" in "remaining"
git push origin feature/maintain-state              # blocked — "main" in "maintain"
git push origin fix/mainframe-bug                   # blocked — "main" in "mainframe"

The fix requires main/master to appear as a standalone ref target by checking the preceding character is a whitespace, colon (refspec), slash (fully-qualified ref), or + (force-push prefix):

-git[[:space:]]+push.*(main|master)
+git[[:space:]]+push[[:space:]].*([[:space:]]|:|/|\+)(main|master)([[:space:]]|$)

This matches the rigor level applied to the rm hook in #33.

Blocked:

• git push origin main
• git push -u origin main
• git push origin feature:main (refspec)
• git push origin refs/heads/main (fully-qualified)
• git push origin +main (force prefix)
• git push origin HEAD:refs/heads/main

Allowed:

• git push -u origin deps/aiohttp-3.13.5-remaining
• git push origin feature/maintain-state
• git push origin fix/mainframe-bug
• git push (bare push to tracking branch)

Find the git push PreToolUse hook and inspect its current branch-name regex, then compare its matching rules with the rm hook referenced in #33. Update the matching behavior so the listed protected refs are blocked while the allowed branch names and bare push remain allowed.