Match push.default Case-Sensitively in the Write Guard or Say It Is Folded #3061

The write guard's _configured_push_branches lowercases the push.default value before matching it, so a miscased value such as Current is read as current and yields only the branch's own name. Git parses push.default case-sensitively and refuses a push carrying a malformed value, so this opens no protection gap. The agent-safety READMEs say a value git does not define is read as both destinations, which the guard does not do for a miscased value.

Constructed case: in a scratch repository, git -c push.default=Current push --dry-run is refused by git as a malformed value, while the guard's reading of the same configuration returns only the current branch.

Done when the code and the READMEs agree: either the guard stops lowercasing, so a miscased value reads as both, or the READMEs say how case is read.

Found by a local review pass on the #3051 promotion fix for the README wording.