Never Let Git Read a .git Your Coding Agent Wrote
A worker can plant .git/config with hooks or an fsmonitor command, and a routine git status runs it. Hematron points git at a daemon-owned GIT_DIR, reads policy from the base commit, and binds evidence to commit hashes.