Fix the pre-commit risk scan for an AI diff

You built a backend feature with an AI agent: a new endpoint, a database query, some config and two new dependencies. Rather than read every line, your team runs a quick pass over the diff for the places AI code most often goes wrong: secrets, injection, auth, validation, logging and dependencies.

An assistant wrote scan_ai_diff_for_risks(diff_lines). It is in the editor. It has a bug. Find it and fix it.

Input and output:

• diff_lines: the lines of a unified diff.
• Return the checks the diff trips, each at most once, in this fixed order: "secrets", "injection", "auth", "validation", "logging", "dependency".

Rules the tests check:

• Only added lines count: lines that start with +, including a +++ file header. Remove the first +, then lowercase the rest. Every check below looks at that text.
• "secrets": it contains sk_live, api_key or password.
• "injection": it contains query or exec, and also contains a +, a sign the statement is built by joining strings.
• "auth": it contains router. but not requireauth.
• "validation": it contains req.body but not validate.
• "logging": it contains log( or capture(, and also payload.
• "dependency": it contains ^, the mark of a version range in a package manifest.