fix(hooks): use array-based file iteration for safety check

mapfile + array prevents word-splitting issues with filenames
containing spaces or other shell-special characters. Affects both
the affected-files listing and the stale-index safety check.

Without this fix, a filename like 'My Module.php' would be split
into 'My' and 'Module.php', causing the disk-existence check to
look for wrong paths.

scripts/pre-commit-checks.sh

@@ -28,25 +28,26 @@ fi
 #    - composer.json   PHP-Abhaengigkeiten
 #    - composer.lock   Lock-File
 # ─────────────────────────────────────────────────────────────
-PHP_TOUCHED=$(git diff --cached --name-only --diff-filter=ACMR \
+# PHP-relevante Files (Array-basiert, robust gegen Spaces/Newlines in Filenames)
+mapfile -t PHP_TOUCHED_ARR < <(git diff --cached --name-only --diff-filter=ACMR \
   | grep -E '\.(php)$|^phpunit\.xml$|^composer\.(json|lock)$' || true)
 
-if [ -n "$PHP_TOUCHED" ]; then
+if [ "${#PHP_TOUCHED_ARR[@]}" -gt 0 ]; then
   echo ""
   echo "==> PHP-Dateien geaendert -> PHPUnit wird ausgefuehrt"
   echo "    Betroffene Dateien:"
-  printf '    - %s\n' $PHP_TOUCHED
+  printf '    - %s\n' "${PHP_TOUCHED_ARR[@]}"
 
   # Safety-Check: alle gestaged PHP-Dateien muessen auf der Disk existieren.
   # Sonst wuerde PHPUnit eine inkonsistente Codebasis testen (Staged != Working Tree).
-  MISSING=""
+  MISSING=()
-  for f in $PHP_TOUCHED; do
+  for f in "${PHP_TOUCHED_ARR[@]}"; do
-    [ -f "$f" ] || MISSING="$MISSING $f"
+    [ -f "$f" ] || MISSING+=("$f")
   done
-  if [ -n "$MISSING" ]; then
+  if [ "${#MISSING[@]}" -gt 0 ]; then
     echo ""
     echo "FEHLER: Gestaged PHP-Dateien existieren nicht auf der Disk:"
-    printf '    - %s\n' $MISSING
+    printf '    - %s\n' "${MISSING[@]}"
     echo "    Loesung: 'git restore --staged <datei>' oder Working-Tree synchronisieren."
     exit 1
   fi