Keep a Bare Push's Branch Unresolved Behind an Unrecognized env Option in the Write Guard #3728

Raised by the third review round of promotion #3715 (P1 thread) on the change #3727 made.

_bare_branch in host-setup/agent-safety/claude/gh-write-guard.py reads the branch a push naming no refspec writes. Behind an env option the guard does not recognize (cmd.undetermined), #3727 falls back to reading that branch in cmd.cwd with the command-carried GIT_DIR, as if the option were absent. That fallback re-anchors the check through the very option that moved it. Constructed case, run from a feature branch:

env --ch=/srv/other git push origin

git runs in /srv/other, whose checked-out branch may be main, while _bare_branch returns the caller's feature branch and the protected main push is allowed.

Fix: behind an unrecognized env option, leave a bare push's branch unresolved, so a protected default fails closed, unless the repository is named independently of the option by a safely resolved absolute anchor (an absolute --git-dir, git's own -C with an absolute path, or an absolute cd). Add a no-refspec regression case. A bare push behind an unrecognized env option from a feature branch may now be refused, which is the intended cost.

Backlog burndown claim. Branch: feature/burndown-guard-bare-branch. Predicted file set: host-setup/agent-safety/claude/gh-write-guard.py, host-setup/agent-safety/README.md.