Read a Run-Time Word Before gh's Command and a Bare GH_REPO export in the Write Guard #3136

Context

Found by the local review of the lane closing #3093, #3080, #3067, #3089, #3079, and #3069. Develop's guard shares both gaps. Each was confirmed with classify probes on constructed commands, origin example/repo, against develop's guard and that lane's branch.

A Run-Time Word Before gh's Command Hides a Write's Target

That lane reads a run-time word before gh's command as a possible merge, since it may expand to a flag and its value. It reads no other write that way, so a run-time word that may be a repo flag hides the write and its target:

• R=${REPO:+-R $REPO}; gh $R pr comment 5 --body hi is allowed, and is not read as a write at all.

A Bare export of GH_REPO Is Not Read

A plain assignment followed by a bare export GH_REPO reaches gh, and _export_assignments reads only NAME=value arguments:

• GH_REPO=stranger/example; export GH_REPO; gh pr comment 5 --body hi is allowed.

Possible Direction

Read a gh argv whose path holds a run-time word before a literal command and subcommand naming a write as that write, with its run-time word failing closed as a repository it cannot read. Read a bare export NAME as exporting the latest plain assignment to NAME before it. Check both with a develop-versus-branch differential.