Build the argv tail (after -C <workdir>) for `git diff
..` with the `--end-of-options` guard interposed
(issue #100). Both `base` and `head` flow from user-controlled
surfaces (`branch..merge`, `branch..gwm-base`,
`[review].default_base`, branch names), so a value like
`--upload-pack=/tmp/x` would otherwise be parsed as a git option
(the CVE-2017-1000117 shape) on susceptible git versions. The
`--end-of-options` separator forces every token after it to be
treated as a positional ref — modern git mandates this defensive
pattern even when its own argument parser would not be tricked
today.
Public for unit-testing the contract; the wrappers
materialise_diff and count_commits_ahead are the actual
shell-out sites.