Bug: Regex metacharacters in protected branch patterns are not escaped

[404-Page-Found]

Description

In src/core/safety.ts:11:

const regex = new RegExp(`^${pattern.replace(/\*/g, '.*')}$`)

The code only replaces * with .* but does not escape other regex metacharacters such as ., +, ?, [, ], (, ), {, }, |, ^, $, and \.

Impact

A pattern like release-1.0 becomes the regex ^release-1.0$ where . matches any character. This would incorrectly match release-1X0, release-1-0, release-1a0, etc. This undermines the branch protection mechanism.

Suggested Fix

Escape all regex metacharacters before replacing wildcards.