perf(tools): stop safe git commands spawning alias-lookup subprocesses

_KNOWN_GIT_BUILTINS omitted reset/stash/clean/restore (whose dangerous
forms _mutates_worktree already classifies first) and common read-only
porcelain (reflog, ls-files, cat-file, shortlog, show-ref, ls-tree,
ls-remote, merge-base). Every safe use inside the source repo — 'git
stash list', 'git reset --soft', 'git clean -n', 'git restore --staged'
— fell through to _read_git_alias and spawned a 'git config --get
alias.X' subprocess per terminal command (~10ms, 1s worst case on a
locked config). Complete the builtin set; the mutation classification
is unchanged and runs first.

tools/self_repo_guard.py

@@ -39,6 +39,14 @@ _KNOWN_GIT_BUILTINS = frozenset({
     "blame",
     "branch",
     "bundle",
+    "cat-file",
+    # `reset`/`stash`/`clean`/`restore` reach this set only in their SAFE
+    # forms — _mutates_worktree classifies the dangerous forms first (see
+    # _inspect_git) — so listing them here only prevents a pointless
+    # `git config --get alias.<sub>` subprocess for `stash list`,
+    # `reset --soft`, `clean -n`, `restore --staged`, which agent dev
+    # sessions run constantly inside the source repo.
+    "clean",
     "clone",
     "commit",
     "config",
@@ -50,18 +58,28 @@ _KNOWN_GIT_BUILTINS = frozenset({
     "help",
     "init",
     "log",
+    "ls-files",
+    "ls-remote",
+    "ls-tree",
     "maintenance",
+    "merge-base",
     "mv",
     "notes",
     "push",
     "range-diff",
+    "reflog",
     "remote",
     "repack",
     "replace",
+    "reset",
+    "restore",
     "rev-list",
     "rev-parse",
     "rm",
+    "shortlog",
     "show",
+    "show-ref",
+    "stash",
     "status",
     "submodule",
     "tag",