Name the uv No-Cache Setting When the Resolved PyYAML Interpreter Vanishes - #3707

…d Unread Moves Whole, and Name uv's No-Cache Setting (#3715)

Promotes the changes merged into `develop` since promotion #3703 to
`main`, the third round of a backlog burndown.

- [#3709](#3709) Reads a
push's remote, and the branch of a push with no refspec, in the
repository git actually uses in the write guard's owner check
(requirement 4). Before, `--git-dir` and a `GIT_DIR` on the push were
ignored, so a constructed `git --git-dir=<other>/.git push origin
develop` was checked against the working directory's repository rules
and allowed. A shape whose repository the guard cannot determine (an
earlier `GIT_DIR`, a `-c` or `--config-env` override of a `remote.` or
`url.` key, any `GIT_CONFIG*` variable, an unresolvable `--git-dir`) now
blocks `main`, `master` and `develop`. The self-test covers each shape
and `host-setup/agent-safety/README.md` states the requirement.
- [#3712](#3712) Reads a
file moved out of a source some rule never read in full for that rule in
the prose gate: a narrowed directory scope, a `home_path_exempt` file,
instruction text for `issue-ref`, and a move that changes the file's
lexer. Skips YAML block scalars when reading a Compose file's volume
entries.
- [#3707](#3707) Names
uv's no-cache setting, and its remedies, when the repo gate's resolved
PyYAML interpreter is gone at launch, rather than reporting a bare
missing-file error.
- [#3708](#3708) Moves the
section-name lookup key into one `section_key()` in
`spec/fidelity_text.py`, used by the carry, the audit, the skill build
and the review ledger, with no behavior change.

- [#3722](#3722) Applies
`env`'s directory and environment options to the command the write guard
judges, answering this promotion's first review round: `env
-C`/`--chdir` move the repository a relative `GIT_DIR` and the remote
resolve in, `env -i`/`-u` clear a `GIT_DIR` that no longer steers the
check, and `env -S` is read rather than skipped. A run-time directory
reads as undetermined, which blocks `main`, `master` and `develop`.
- [#3721](#3721) Finds a
Compose block-scalar opener through the YAML lexer the gate already uses
rather than a hand-written pattern, so a key holding `#`, quoted or not,
opens the opaque region. Also answers this promotion's first review
round.

- [#3727](#3727) Reads an
`env` option the write guard does not recognize, such as GNU `env`'s
`--ch` abbreviation of `--chdir`, as leaving the push's repository
undetermined, so `main`, `master` and `develop` fail closed, answering
this promotion's second review round. A feature-branch push is never
newly blocked.

- [#3731](#3731) Removes
the fallback #3727 kept for a push naming no refspec behind an
unrecognized `env` option, answering this promotion's third review
round. Such a push resolves its branch only through an absolute
`--git-dir`, git's own `-C`, or a `cd` in a wrapper body, and is
otherwise read as writing every protected default, so it fails closed
even from a feature branch.

Deferred review findings: #3705 (`scripts/README.md`'s uvx promise),
#3706 (`validate.py`'s exact section-name match), #3710 (whether
`section_key` should casefold), #3711 (Compose-name and directory moves
in the prose gate), #3713 (the review reader's `open review findings:`
spelling), #3714 (an edited shebang that changes a file's lexer), #3720
(the write guard's reading of `git push -o<value>`), #3723 (unused
`_bare_push_branch` parameters), #3729 (a bare push after a branch
switch earlier in the same command), #3732 (the review reader's `Review
findings remain:` spelling).

For the maintainer: #3730 asks whether every bare push whose repository
the guard cannot determine should fail closed, as #3731 now does behind
an unrecognized `env` option.

Fixes #3695
Fixes #3684
Fixes #3694
Fixes #2358
Fixes #3686
Fixes #3716
Fixes #3717
Fixes #3725
Fixes #3728

🤖 Generated with [Claude Code](https://claude.com/claude-code)