fix(status): use git add --renormalize so -f actually re-encrypts

Root cause of the intermittent Windows failure, confirmed by evidence
from a 30x stress run: git add skipped the file entirely.

  index entry:  100644 dfbd3cbb... bad.secret
  HEAD blob:           dfbd3cbb...            <- identical
  index bytes:  "should-be-"                 <- plaintext
  check-attr:   filter: git-crypt             <- attribute in effect
  filter.git-crypt.clean: configured

The filter was configured and the attribute applied, yet git add exited 0
having done nothing. Only .gitattributes had changed; the working file was
byte-identical to what was committed, so git's stat cache said there was
no work and the clean filter was never invoked. It surfaced only
intermittently because git re-hashes 'racily clean' files (mtime not
strictly older than the index) as a safeguard, which usually masked it.

This was never merely a flaky test. status -f would report 're-staged N of
M file(s)' while leaving the plaintext secret staged — a false assurance
about the exact thing the command exists to fix.

--renormalize re-applies the clean process to tracked files
unconditionally. It does not stage untracked files, so -f still refuses to
auto-add them.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TYMP8eH52L6rNdjbukfuyZ

Author: lucatescari

.github/workflows/stress-windows.yml

@@ -20,10 +20,10 @@ jobs:
       - name: Build test binary once
         run: cargo test --test integration --no-run
 
-      - name: Run the flaky test until it fails (max 30 attempts)
+      - name: Run the flaky test until it fails (max 50 attempts)
         shell: bash
         run: |
-          for i in $(seq 1 30); do
+          for i in $(seq 1 50); do
             echo "::group::attempt $i"
             if ! cargo test --test integration test_status_fix_restages_only_warning_files -- --exact --nocapture; then
               echo "::endgroup::"
@@ -32,4 +32,4 @@ jobs:
             fi
             echo "::endgroup::"
           done
-          echo "30/30 attempts passed — no reproduction this run"
+          echo "50/50 attempts passed — no reproduction this run"

src/commands/status.rs

@@ -172,8 +172,19 @@ pub fn status(
                     );
                     continue;
                 }
+                // `--renormalize` is required, not cosmetic. A plain
+                // `git add` consults the stat cache first: the working file
+                // is byte-identical to what was committed, only
+                // `.gitattributes` changed, and git cannot see that from
+                // stat data. So it decides there is nothing to do, exits 0,
+                // and never invokes the clean filter — leaving the plaintext
+                // blob staged while we report success. It only appeared
+                // intermittently because git re-hashes "racily clean" files
+                // (mtime not strictly older than the index) as a safeguard.
+                // `--renormalize` re-applies the clean process to tracked
+                // files unconditionally, which is exactly the intent here.
                 let st = Command::new("git")
-                    .args(["add", "--"])
+                    .args(["add", "--renormalize", "--"])
                     .arg(file)
                     .status()
                     .map_err(|e| GitVeilError::Git(format!("failed to stage {}: {}", file, e)))?;