Read Persisted Config a Command Writes Before an Alias or Commit in the Write Guard #3303

Context

Found by the local review of the change closing #3046, #3047, #3055, #3057, #3072, #3078, and #3081. Develop's guard shares it.

A Command Earlier in the Same Call Can Write the Persisted Config the Guard Reads

host-setup/agent-safety/claude/gh-write-guard.py reads persisted git config before the command runs. That change taught the push reads to treat a git config or git remote earlier in the same call as rewriting the remote config. The two alias walks and the hooks-path read do not do the same, so a persisted value the command writes first is never read.

Constructed cases, each allowed:

• git config alias.p push && git p origin develop pushes to develop.
• git config alias.rh 'reset --hard' && git rh, run in a primary checkout, hard-resets it.
• git config core.hooksPath /dev/null && git commit -m x skips the commit hooks. A standalone git config core.hooksPath /dev/null also persists the bypass for later commands.

Possible Direction

Where a git config that does not only read runs before an alias-shaped subcommand in the same command, read the persisted alias as unresolved in both walks. _config_may_change already says which commands count. A persisted core.hooksPath write is a hook bypass of its own and may want the same treatment as the -c override.