H #2915: cover chunked scanning of large multi-file push diffs

Test-only coverage for behavior already on main: a clean two-file pushed
diff over the engine's 1 MiB cap passes without engine.input_too_large, and
a credential at the end of the second file (a later scan chunk) still
blocks the push.

Co-authored-by: pneumorea-ai <pneumorea@gmail.com>

test/redact-prepush-hook.test.ts

@@ -118,6 +118,32 @@ describe("pre-push hook gating", () => {
 const RELEASE = ["1", "84", "1", "0"].join(".");
 const PUBLIC_IP = ["8", "8", "8", "8"].join(".");
 
+describe("pushed diffs larger than the engine cap are scanned in chunks (#2915)", () => {
+  const commitLarge = (tail: string): { base: string; head: string } => {
+    const base = git(["rev-parse", "HEAD"]);
+    fs.writeFileSync(path.join(repo, "large-a.txt"), "clean-a ".repeat(90_000));
+    fs.writeFileSync(path.join(repo, "large-b.txt"), "clean-b ".repeat(90_000) + tail);
+    git(["add", "large-a.txt", "large-b.txt"]);
+    git(["commit", "-q", "-m", "large diff"]);
+    return { base, head: git(["rev-parse", "HEAD"]) };
+  };
+
+  test("a clean two-file diff over the cap passes without input_too_large", () => {
+    const { base, head } = commitLarge("");
+    const { code, stderr } = runHook(`refs/heads/main ${head} refs/heads/main ${base}\n`);
+    expect(code).toBe(0);
+    expect(stderr).not.toContain("engine.input_too_large");
+  });
+
+  test("a credential in a later file's chunk still blocks", () => {
+    const { base, head } = commitLarge("\n" + FAKE_AWS_KEY + "\n");
+    const { code, stderr } = runHook(`refs/heads/main ${head} refs/heads/main ${base}\n`);
+    expect(code).toBe(1);
+    expect(stderr).toContain("aws.access_key");
+    expect(stderr).not.toContain("engine.input_too_large");
+  });
+});
+
 describe("release version exemption (#2856)", () => {
   const mediums = (stderr: string): number => Number(/(\d+) MEDIUM finding/.exec(stderr)?.[1] ?? 0);
   const commitAll = (files: Record<string, string>, msg: string): string => {