bug: CSA git guard blocks local fixture git init in focused Just gates

[RyderFreeman4Logos]

Repro

CSA session 01KZSBDVP0M5THZRHEB5RJJDJ6 at /home/obj/.local/state/cli-sub-agent/home/obj/project/github/RyderFreeman4Logos/codeseek/sessions/01KZSBDVP0M5THZRHEB5RJJDJ6 runs a focused Codeseek Just gate. The injected git wrapper only allows its local-command allowlist, which excludes init.

Commands (both exited 101 through Just):

TMPDIR/TMP/TEMP=/mnt/ssd/mirror-rootfs/home/obj/tmp/tmp just test-workflow-adk run_adk_publishes_mock_three_arm_artifacts_without_a_rename_conflict

Fixture calls and stderr excerpts:

git ["init", "-q"] failed: CSA git-guard: blocked command: git <command> <option>
git ["init"] failed: CSA git-guard: blocked command: git <command>
Use a hermetic local bare fixture under $CSA_SESSION_DIR/git-fixtures and push to its direct canonical path or file:// URL.

git init is local-only, while the supplied fixture-push exception cannot bootstrap a source repository because the guard also blocks init. Existing Codeseek integration fixtures rely on temp repositories, so the published guidance to switch --quiet to -q does not resolve this gate.

Expected

Permit a safe local git init grammar (including -q / --quiet) under the guard, or provide a supported bootstrap mechanism for a real temporary worktree fixture without granting generic push authorization.