gitcommit.sh --only ADDS paths instead of RESTRICTING the commit to them, so the fleet strict-repo rule does not deliver what it promises

Reported by db-terra-cc 2026-09-12 while complying with a fleet-wide stop, NOT independently measured by me - confirm against the script before acting. It held 2 new evidence files beside ~41 older untracked artefacts in agents/db-terra/evidence/ and correctly refused to commit, because a hand commit would have swept 43 files including other lanes'. A flag named --only that WIDENS scope is the worst possible naming for a safety control: every agent following the documented strict-repo path believes the commit is scoped when it is not, and it succeeds either way so nothing surfaces. FIRST establish which is true - does --only add to the index, or restrict the commit to the given paths. If it adds: either make it restrict (git commit -- <paths>, index untouched) or rename it to --add and introduce a real --only. Renaming alone is acceptable and cheaper; a lying name is the defect. Acceptance must force a red arm: with an unrelated untracked file present, show that --only does NOT include it. A green run in a clean tree proves nothing, and this defect only appears when other untracked files exist. Coordinate the push across all three hosts per the PATH-scripts rule.