Pack

`git-safe`

Allow git reads; require approval for push, commit, and reset --hard.

Default effect: allow read / approve write

Extend in policy

extends:
  - pack: git-safe

Safe inspection of history and status; human gate before publish and destructive local git ops.