Carry Environment Through an Unknown Launcher to the Git It Runs in the Write Guard #3085

Problem

_command_prefix in host-setup/agent-safety/claude/gh-write-guard.py passes only the precommands it knows. A launcher it does not know, such as flock <file>, stops it, and the environment that launcher passes to git is dropped. The promotion fix for #3064 carries that environment to a wrapper shell's command string. Two sites stay open, and each of these is allowed:

• Git run directly by the launcher, read through _git_word_assignments:

  GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=alias.p GIT_CONFIG_VALUE_0=push flock /example/lock git p origin develop
  GIT_CONFIG_GLOBAL=/example/config flock /example/lock git status

• An env after the launcher, whose assignments _prefix_walk never reaches:

  flock /example/lock env GIT_CONFIG_GLOBAL=/example/config bash -c 'git status'

The same forms behind a known precommand, such as timeout 60, are read and denied.

Fix

Read past an unknown launcher the safe way round, as _launcher_prefix does for a wrapper shell. A launcher runs the next command unless _NAMES_ITS_ARGUMENTS names it, and its own env arguments count. Use that reading in _git_word_assignments too. Check against develop with a differential over constructed commands.

Found by a local review pass on the promotion fix for #3064. Develop allows all three.