fix(policies): split comma-separated values on each merged input line
Summary
When a policy input is declared as a comma-separated value in a workflow contract and the same input is also supplied at runtime via --policy-input-from-file (#3244), the additive merge produced a malformed glob: the contract's comma-joined segment was never re-split on commas, collapsing into a single literal value containing commas that matched nothing.
getInputArguments split the merged string on newlines first and, as soon as there was more than one line, returned the multi-line slice as-is — the per-value comma splitting only ran on the single-line branch. As a result a contract value such as **/vendor/**,**/redist/** merged with runtime values yielded ["**/vendor/**,**/redist/**", ...], whose first element is a single glob still containing commas.
This normalizes multi-value inputs consistently: each line is now split on commas as well, so a comma-separated segment is always expanded into separate values regardless of whether a runtime value was appended. Escaped-comma (\,) handling is preserved.
AI assistance
This contribution was produced with the assistance of Claude Code.