Read a Git Alias Expansion Past Its Leading Global Options in the Write Guard #3081

Problem

host-setup/agent-safety/claude/gh-write-guard.py takes the first word of a git alias expansion as the subcommand it runs. Git reads leading global options in an expansion first, -p and -c among them, then the subcommand. For example, an alias of -p rev-parse --is-inside-work-tree runs rev-parse.

Constructed cases:

• A persisted alias.q = -c color.ui=never push, then git q origin develop. _alias_chain_runs_push and _alias_runs_push read -c as the subcommand, so _hidden_command does not see a push.
• A persisted alias.wipe = -p reset --hard, then git wipe in a primary checkout. Rule 6's _resolve_alias reads -p as the subcommand, so the reset is not judged.

Fix

Read an alias expansion past its leading global options with the same reader a git command's own options use (_git_subcommand_index), in both alias walks. Check against develop with a differential over constructed commands.

Found by a local review pass on the promotion fix for #3064. It is pre-existing on develop.