Fix the install plan screen for Go modules

Setting up a Go project, your AI assistant told you to run go get github.com/gintools/gin-helpers and then go run ./.... The module's name is close to the popular gin framework, which smells like a typosquat, and go run would execute whatever was just fetched. Your team now screens every install plan an assistant suggests before anyone runs it.

An assistant wrote screen_install_plan(commands, trusted_modules). It is in the editor. It has a bug. Find it and fix it.

Input and output:

• commands: the plan's shell commands, in order.
• trusted_modules: the module paths your team has already vetted.
• Return the findings in order, without repeats.

Rules the tests check:

• Normalize each command first: trim it and turn every run of whitespace inside it, tabs included, into one space. A shell treats them all alike. Findings show the normalized command.
• A command that starts with go get fetches a module: the text after go get , cut at the first @ (a version) and trimmed. Skip the command if that is empty.
  • If the module is exactly one of trusted_modules, nothing happens.
  • Otherwise it is an untrusted fetch. Its name is the last / segment of its path. If that name contains, or is contained in, the name of any trusted module, add "verify-module:<module>". Ignore empty names in this comparison.
• A command that starts with go run or go test runs code. If an untrusted fetch came earlier in the plan, add "review-before-run:<command>".