test(submodule): cover commit hash validation branches

Add focused tests for the private commit hash validator so SonarQube and Codecov can account for the short-hash and non-hex rejection branches.

Local verification:

- npm run lint --workspace git-id-switcher -- --no-cache

- npm run compile --workspace git-id-switcher

- npm run test:coverage --workspace git-id-switcher

Signed-off-by: Null;Variant <null@nullvariant.com>

🖥️ IDE: [Zed](https://zed.dev/)

Co-authored-by: GPT-5.5 <codex@openai.com>
Model-Raw: gpt-5.5

Author: nullvariant

extensions/git-id-switcher/src/core/submodule.ts

@@ -529,3 +529,10 @@ export function getSubmoduleDepth(): number {
 export function getMaxSubmoduleDepth(): number {
   return MAX_SUBMODULE_DEPTH;
 }
+
+/**
+ * Test-only exports for private validation helpers.
+ */
+export const __testExports = {
+  isValidCommitHash,
+};

extensions/git-id-switcher/src/test/submodule.test.ts

@@ -22,6 +22,7 @@ import {
   setIdentityForSubmodules,
   isSubmoduleSupportEnabled,
   getSubmoduleDepth,
+  __testExports,
 } from '../core/submodule';
 import { _resetCache, _setMockVSCode } from '../core/vscodeLoader';
 
@@ -402,6 +403,33 @@ function testWorkspaceBoundary(): void {
   console.log('  Workspace boundary enforcement passed');
 }
 
+/**
+ * Test commit hash validation branch coverage.
+ */
+function testCommitHashValidation(): void {
+  console.log('Testing commit hash validation...');
+
+  const { isValidCommitHash } = __testExports;
+
+  assert.strictEqual(
+    isValidCommitHash('0123456789abcdef0123456789abcdef01234567'),
+    true,
+    '40-character lowercase hex hash should be valid'
+  );
+  assert.strictEqual(
+    isValidCommitHash('a'.repeat(39)),
+    false,
+    'Short hash should be invalid'
+  );
+  assert.strictEqual(
+    isValidCommitHash('g'.repeat(40)),
+    false,
+    'Non-hex hash should be invalid'
+  );
+
+  console.log('  Commit hash validation tests passed');
+}
+
 /**
  * Test regex pattern strictness (40-char SHA-1)
  *
@@ -1139,6 +1167,7 @@ export async function runSubmoduleTests(): Promise<void> {
     testPermissionErrorHandling();
     testMaxSubmoduleDepth();
     testWorkspaceBoundary();
+    testCommitHashValidation();
     testRegexPatternStrictness();
     testInvalidWorkspacePaths();