Keep the Write Guard's Terminal-Option Exception When a Redirection Precedes the Option #2981

Context

#2979 made gh-write-guard deny a redirection where git's subcommand goes or among its global options, unless git's first word is a terminal option such as --version. That pull request listed the narrow exception as a known over-denial. The first Copilot round on the #2980 promotion raised it again, in its file table only, with no thread: "preserve the terminal-option exception after redirections".

What Denies

A classify probe on constructed commands against develop's guard at 4a0370f:

• allow: git --version >/dev/null 2>&1
• deny: git >/dev/null --version
• deny: git 2>&1 --version
• deny: git >/dev/null 2>&1 --version
• deny: git 2>/dev/null --help
• deny: git --exec-path >/dev/null, where --exec-path with no value is itself a terminal option, so the exception does not reach it even as git's first word

Each of these only denies, so none is an allow gap, and none runs a subcommand that could push or commit.

Possible Direction

Read the redirections out first and apply the terminal-option exception to git's first remaining word, and treat a valueless --exec-path as terminal. Keep the deny wherever the first non-redirection word is not terminal. As a change to the safety hook, it keeps develop's readings, adds the narrower reading beside them, and runs the develop-versus-branch differential before its push, so it introduces no allow flip outside this class.