Fail Closed on an --admin a Run-Time Word Spells in the Write Guard #3006

Context

Found by the local review of the lane closing #2957. Develop's guard shares it. It was found by reading _check_bypass_flags.

An --admin a Run-Time Word Spells Is Not Failed Closed

The push side fails closed on a run-time word among a push's words. The --admin check reads only the literal flag, so a word the shell rewrites into it passes:

• gh pr merge 5 "$(printf %s --admin)"
• A=--admin; gh pr merge 5 $A

Possible Direction

Fail closed on a run-time word among the arguments of gh pr merge, the way _rewritten_git_words does for a push or a commit, with the workaround of writing every word out.