bug: CSA git guard blocks git version in lefthook

[aider4ryder]

The CSA git guard emits a false-positive block for git version invoked by a repository pre-commit hook. The hook ultimately exits successfully, but the guard output is unexpected and can make a valid local gate look broken.

• Session ID: 01KZRK013A0S9616A4GW4CJWFF
• Session directory: /home/obj/.local/state/cli-sub-agent/home/obj/project/github/RyderFreeman4Logos/mempal/sessions/01KZRK013A0S9616A4GW4CJWFF
• Command: lefthook run pre-commit
• Exit code: 0
• stderr excerpt:

  CSA git-guard: blocked command: git <command>
  Use a hermetic local bare fixture under $CSA_SESSION_DIR/git-fixtures and push to its direct canonical path or file:// URL.
  

Expected: read-only git version remains allowed so scripts/hooks/branch-protection.sh can run without a spurious guard diagnostic.

[aider4ryder]

Additional repro from the same CSA session:

• Command: just local-gates
• Exit code: 101
• Session ID: 01KZRK013A0S9616A4GW4CJWFF
• Session directory: /home/obj/.local/state/cli-sub-agent/home/obj/project/github/RyderFreeman4Logos/mempal/sessions/01KZRK013A0S9616A4GW4CJWFF

The local gate completed formatting, monolith, strict all-features clippy, and the 898 default unit tests. It then failed 13 tests in tests/local_gate_receipt_scripts.rs before fixture setup because the guard blocked git init --quiet:

git ["init", "--quiet"] failed: stdout=, stderr=CSA git-guard: blocked command: git <command> <option>
Use a hermetic local bare fixture under $CSA_SESSION_DIR/git-fixtures and push to its direct canonical path or file:// URL.

Those tests deliberately create isolated Git fixtures and do not push. The guard needs to permit safe local Git setup commands (at least git init --quiet) in the CSA session fixture area.