test(cli): cover publish-time warning helpers

Add fires/no-op pairs for gitignoredTrackedWarning, untrackedFilesWarning,
and submoduleWarning. The submodule case writes a hand-crafted .gitmodules
file rather than wiring real submodules — submodulePaths reads the file
directly so that's sufficient.

cmd/ninja/cmd/plugin_test.go

@@ -1,6 +1,7 @@
 package cmd
 
 import (
+	"bytes"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -108,6 +109,123 @@ func gitHeadSHA(t *testing.T, dir string) string {
 	return strings.TrimSpace(string(out))
 }
 
+func TestGitignoredTrackedWarning_FiresWhenTrackedFileMatchesGitignore(t *testing.T) {
+	dir := t.TempDir()
+	runGit(t, dir, "init", "-q")
+	if err := os.WriteFile(filepath.Join(dir, "secret.env"), []byte("token=abc"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	runGit(t, dir, "add", "secret.env")
+	runGit(t, dir, "commit", "-qm", "init")
+	if err := os.WriteFile(filepath.Join(dir, ".gitignore"), []byte("*.env\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	runGit(t, dir, "add", ".gitignore")
+	runGit(t, dir, "commit", "-qm", "ignore")
+
+	var buf bytes.Buffer
+	gitignoredTrackedWarning(dir, &buf)
+
+	out := buf.String()
+	if !strings.Contains(out, "secret.env") {
+		t.Errorf("warning should list secret.env, got: %q", out)
+	}
+	if !strings.Contains(out, "git rm --cached") {
+		t.Errorf("warning should suggest `git rm --cached`, got: %q", out)
+	}
+}
+
+func TestGitignoredTrackedWarning_NoopWhenNothingMatches(t *testing.T) {
+	dir := t.TempDir()
+	runGit(t, dir, "init", "-q")
+	if err := os.WriteFile(filepath.Join(dir, "README.md"), []byte("hi"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	runGit(t, dir, "add", "README.md")
+	runGit(t, dir, "commit", "-qm", "init")
+
+	var buf bytes.Buffer
+	gitignoredTrackedWarning(dir, &buf)
+	if buf.Len() != 0 {
+		t.Errorf("expected empty output for clean repo, got: %q", buf.String())
+	}
+}
+
+func TestUntrackedFilesWarning_FiresWithUntrackedFile(t *testing.T) {
+	dir := t.TempDir()
+	runGit(t, dir, "init", "-q")
+	if err := os.WriteFile(filepath.Join(dir, "README.md"), []byte("hi"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	runGit(t, dir, "add", "README.md")
+	runGit(t, dir, "commit", "-qm", "init")
+
+	if err := os.WriteFile(filepath.Join(dir, "notes.txt"), []byte("scratch"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	var buf bytes.Buffer
+	untrackedFilesWarning(dir, &buf)
+
+	out := buf.String()
+	if !strings.Contains(out, "notes.txt") {
+		t.Errorf("warning should list notes.txt, got: %q", out)
+	}
+	if !strings.Contains(out, "git add") {
+		t.Errorf("warning should suggest `git add`, got: %q", out)
+	}
+}
+
+func TestUntrackedFilesWarning_NoopWithNoUntracked(t *testing.T) {
+	dir := t.TempDir()
+	runGit(t, dir, "init", "-q")
+	if err := os.WriteFile(filepath.Join(dir, "README.md"), []byte("hi"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	runGit(t, dir, "add", "README.md")
+	runGit(t, dir, "commit", "-qm", "init")
+
+	var buf bytes.Buffer
+	untrackedFilesWarning(dir, &buf)
+	if buf.Len() != 0 {
+		t.Errorf("expected empty output, got: %q", buf.String())
+	}
+}
+
+func TestSubmoduleWarning_FiresWithGitmodules(t *testing.T) {
+	dir := t.TempDir()
+	runGit(t, dir, "init", "-q")
+	gitmodules := `[submodule "vendor/foo"]
+	path = vendor/foo
+	url = https://example.com/foo.git
+`
+	if err := os.WriteFile(filepath.Join(dir, ".gitmodules"), []byte(gitmodules), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	var buf bytes.Buffer
+	submoduleWarning(dir, &buf)
+
+	out := buf.String()
+	if !strings.Contains(out, "vendor/foo") {
+		t.Errorf("warning should mention vendor/foo, got: %q", out)
+	}
+	if !strings.Contains(out, "submodules") {
+		t.Errorf("warning should mention submodules, got: %q", out)
+	}
+}
+
+func TestSubmoduleWarning_NoopWithoutGitmodules(t *testing.T) {
+	dir := t.TempDir()
+	runGit(t, dir, "init", "-q")
+
+	var buf bytes.Buffer
+	submoduleWarning(dir, &buf)
+	if buf.Len() != 0 {
+		t.Errorf("expected empty output, got: %q", buf.String())
+	}
+}
+
 func runGit(t *testing.T, dir string, args ...string) {
 	t.Helper()
 	cmd := exec.Command("git", args...)