Let a Top-Level Command-Text GH_REPO Export Override an Inherited One in the Write Guard #3163

Context

#3162 (for #3147) makes the write guard read a GH_REPO that the session inherits from its environment. Only a command prefix (GH_REPO=example/repo gh ...) or -R/--repo overrides that inherited value. An export in the command text doesn't, and host-setup/agent-safety/claude/README.md documents that. The lane tried to let a command-text export override the inherited value, and three local review rounds each found a new shape where the override leaked: a subshell, a pipe, a case arm, an if or loop body, and a quoted separator. The last attempt also ran in quadratic time on long commands, so the lane deleted the override and kept the deny.

Gap

In a session whose environment holds a foreign GH_REPO, export GH_REPO=example/repo; gh issue comment 5 --body hi is denied, although gh would write to the session's own origin. This is an over-deny, so it fails closed.

Possible Direction

For the over-denial lane: allow a command-text export to override the inherited value only where the export and the gh write share one simple command list at the top level, with no subshell, pipe, compound command, or quoted separator between them, and keep the deny everywhere else. Bound the scan so it stays linear, and add a differential showing no new allow on the #3162 corpus.