Read a Backtick-Opened or Run-Time Git Command Word in the Write Guard #2976

Context

Found while closing #2959 and #2961. Each shape below is allowed by develop's guard and by the #2959/#2961 fix, since both read a git command only from a word the tokenizer gives as git. Each was found by a classify probe on constructed commands, with the branch rules given as a test seam.

Git Words the Guard Never Sees as Git

• A backtick-opened git word. In x=`git push origin develop` and echo `git push origin develop` the tokenizer gives x=`git and `git, which _is_git_exe does not read as git, so no push is read. The $(...) form is read, since ( is an operator there.
• A run-time command word. In G=git; $G push origin develop the command word is $G, so no push is read, and the same holds for "$GIT" push and `which git` push.

Possible Direction

Fail closed rather than model the expansion: read a word opening a backtick substitution with git after it as a git word, and deny a command whose command word holds a $ or a backtick where its next word is push or commit, with the explicit-refspec, own-command workaround the other unreadable denies name.