Block exec-capable Git config in exact-candidate commands #141

Goal

Close the remaining exact-candidate delivery gap discovered during #111: reviewed commit and push commands must not accept executable Git configuration overrides.

Problem

PR #149 closed #111 with a fixed-argv delivery boundary, but the ordinary guarded command path can still accept exec-capable -c or --config-env values. That leaves a residual way to alter execution at the delivery boundary.

Acceptance criteria

• RED regressions cover otherwise-valid reviewed commit and push shapes carrying executable -c values.
• RED regressions cover every --config-env form.
• Only the exact required null-hook and fsmonitor configuration used by the reviewed delivery contract remains allowed.
• All other command-local configuration is rejected before execution with a clear diagnostic.
• Existing fixed-argv delivery behavior remains green.
• Focused adapter tests and the canonical proof suite pass.

Boundary

This is a bounded residual correction from closed #111, not a reopening of the retired general shell-command parser. P2/P3 follow-ups from #111 remain out of scope.