fix: ShellCheck SC2128 in validate.sh + behavioral-equivalence test staging

validate.sh: rename local `cmd` to `test_cmd` in _test_state_already_passed
and run_test_check to avoid ShellCheck SC2128/SC2178 warnings caused by
name collision with the `cmd` array in run_with_timeout.

test-behavioral-equivalence-allowlist.sh: stage files before computing
diff hash, matching compute-diff-hash.sh's current behavior of excluding
untracked files (introduced by dso-fqxu).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: JoeOakhartNava