validate-git-c: review config --get on auto-allow safe list

## Context `git config --get` is on the auto-allow safe list. While `--get` limits it to single-key reads with no write vector, it can expose values like `user.signingkey`, `credential.helper`, or custom config entries. Worth a policy discussion about whether this belongs on auto-allow or should route to `ask`. ## Priority Low — no write vector, information disclosure is limited to git config values.