fix: escape rewrite replacement, diagnostic no-op commit, doc + askpass hardening

- Use function replacer in rewriteBody to prevent $& / $$ / $` / $' pattern
  corruption when alt text or siteUrl contains dollar-sign sequences
- Detect empty staged index after `git add -A` and throw a clear
  "No changes to publish" error instead of a cryptic git failure
- Correct README flat-slug description: single image → <slug>.<ext>,
  multiple → <slug>-1.<ext>, <slug>-2.<ext> (original filename discarded)
- Harden askpass dir resolution: show a Notice and return early if
  getFullPath is absent (desktop-only guard), rather than passing a bad path

Co-Authored-By: Claude <noreply@anthropic.com>

src/images.test.ts

@@ -67,4 +67,12 @@ describe("rewriteBody", () => {
       "![](/assets/img/post-1.png)\n![cap](/assets/img/post-2.jpeg)\n![d](/assets/img/post-3.svg)"
     );
   });
+
+  test("alt text containing $ patterns is preserved verbatim (no replacement-pattern corruption)", () => {
+    const slug = "my-post";
+    const body = "![a $& b $$ c](local.png)";
+    const refs = findImageRefs(body);
+    const { rewrittenBody } = planImages(refs, { slug, strategy: "flat-slug", imagesDir: "assets/img", body });
+    expect(rewrittenBody).toBe("![a $& b $$ c](/assets/img/my-post.png)");
+  });
 });