Decide Whether a Quoted Run-Time -C Value Fails Closed in the Write Guard #3382

Context

Found while closing the run-time GIT_DIR gap, which now fails closed on a mutating git command whose GIT_DIR, GIT_WORK_TREE, --git-dir, or --work-tree value holds a run-time word other than $HOME. Develop's guard shares the case below, and it was confirmed with a classify probe on a constructed command.

A Quoted Run-Time -C Value Still Fails Open

git -C $D reset --hard is denied, since word splitting may split the unquoted value. git -C "$D" reset --hard is allowed. Its quoting reads as one word, so the split check passes, and rule 6 then resolves the literal text $D, which names no checkout. The guard's docstring for _expand_dir records that as the rule's documented fail-open case for a $VAR it cannot resolve. A GIT_DIR="$D" now fails closed, so the two directory channels disagree.

Decision Needed

• Fail closed on a quoted run-time -C value too, on a subcommand rule 6 denies. The two channels then agree, and git -C "$WT" commit in a worktree is denied until the path is written out.
• Keep the documented fail-open for -C. A quoted -C "$dir" stays allowed, as the documented stance has it, and the README states that -C and GIT_DIR differ here.